10551Third-party advisory
http://secunia.com/advisories/10551 CVE-2004-1796
HotNews 0.7.2 - Remote File Inclusion
Record summary
CVE-2004-1796 has a selected CVSS score of 7.5; EIP currently links 3 catalogued exploits.
Description
PHP remote file inclusion vulnerability in HotNews 0.7.2 and earlier allows remote attackers to execute arbitrary PHP code via the (1) config[header] parameter to hotnews-engine.inc.php3 or (2) config[incdir] parameter to hnmain.inc.php3.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 3
Proofs of concept
3Catalogued exploits
ExploitDBHotNews 0.7.2 - Remote File InclusionExploitDB exploitby team_eliteNot analyzed1 file
ExploitDBHotNews 0.x - 'hotnews-engine.inc.php3?config[header]' Remote File InclusionExploitDB exploitby OfficerrrNot analyzed1 file
ExploitDBHotNews 0.x - 'config[incdir]' Remote File InclusionExploitDB exploitby OfficerrrNot analyzed1 file
References
91008608vdb entry
http://securitytracker.com/id?1008608 sourceforge.netConfirmation
http://sourceforge.net/forum/forum.php?forum_id=342594 3332vdb entry
http://www.osvdb.org/3332 3405vdb entry
http://www.osvdb.org/3405 20040104 HotNews arbitary file inclusionmailing list
http://www.securityfocus.com/archive/1/348840 9357vdb entry
http://www.securityfocus.com/bid/9357 hotnews-php-file-include(14140)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/14140 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2004-1796