mcNews 1.x - File Disclosure

Author: frog
type: webapps
platform: php
port: 
date_added: 2002-05-17 
date_updated: 2012-09-22 
verified: 1 
codes: OSVDB-86920 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/4770/info

mcNews is a set of scripts for allowing users to post news stories on a webpage. It will run on most Linux and Unix variants as well as Microsoft Windows operating systems.

mcNews does not sufficiently filter dot-dot-slash (../) sequences from URL parameters. As a result, a remote attacker can disclose the contents of arbitrary web-readable files that exist on a host running the vulnerable software.

http://target/admin/header.php?voir=hop&skinfile=../../file