[25499] in bugtraq
Re: Phorum 3.3.2a remote command execution
daemon@ATHENA.MIT.EDU (Gabriel A. Maggiotti)
Sat May 18 15:33:52 2002
Message-ID: <3CE6A44B.207D31C4@ciudad.com.ar>
Date: Sat, 18 May 2002 15:58:19 -0300
From: "Gabriel A. Maggiotti" <gmaggiot@ciudad.com.ar>
Reply-To: gmaggiot@ciudad.com.ar
MIME-Version: 1.0
To: Markus Arndt <markus-arndt@web.de>
Cc: bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Markus Arndt wrote:
> Target:
> Phorum 3.3.2a (prior versions?)
>
> Description:
> In Phorum 3.3.2a (a bulletin board) there's a security flaw that lets remote users
> include external php scripts and execute arbitary code.
Also admin.php is explotable ;)
forum/plugin/replace/admin.php: include("$PHORUM[settings_dir]/replace.php");
