Exploitation Summary
EIP tracks 2 public exploits for CVE-2005-0859. PoCs published by SHiKaA, brOmstar.
AI-analyzed exploit summary This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in CzarNews versions up to 1.14. It allows an attacker to include and execute arbitrary remote files via the 'tpath' parameter in 'news.php' or 'cn_config.php'.
Description
PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to (1) headlines.php or (2) news.php. NOTE: some sources have reported the "dir" parameter as being affected; however, this is likely a cut-and-paste error from the wrong section of the original vulnerability report. Also, the news.php version was later reported to be in 1.12 through 1.14.
Exploits (2)
This exploit demonstrates a Remote File Inclusion (RFI) vulnerability in CzarNews versions up to 1.14. It allows an attacker to include and execute arbitrary remote files via the 'tpath' parameter in 'news.php' or 'cn_config.php'.
The provided text describes a remote file-include vulnerability in CzarNews 1.13b, allowing arbitrary server-side script execution via a malicious URL parameter. No actual exploit code is included, only a description and example URL.