CVE-2010-1342

Direct News 4.10.2 - Remote Code Execution via PHP File Inclusion

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-1342. PoCs published by mat.

AI-analyzed exploit summary This exploit demonstrates multiple remote file inclusion vulnerabilities in Direct News 4.10.2 by manipulating the `rootpath` and `adminroot` parameters to include arbitrary remote scripts. The PoC provides clear examples of vulnerable code snippets and usage instructions.

Description

Multiple PHP remote file inclusion vulnerabilities in Direct News 4.10.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to (1) admin/menu.php and (2) library/lib.menu.php; and the adminroot parameter to (3) admin/media/update_content.php and (4) library/class.backup.php. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WORKING POC VERIFIED

by mat · textwebappsphp

https://www.exploit-db.com/exploits/11882

View Code ZIP pw:eip

This exploit demonstrates multiple remote file inclusion vulnerabilities in Direct News 4.10.2 by manipulating the `rootpath` and `adminroot` parameters to include arbitrary remote scripts. The PoC provides clear examples of vulnerable code snippets and usage instructions.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Direct News 4.10.2

No auth needed

Prerequisites: Target server must have allow_url_include enabled in PHP configuration · Attacker must be able to host a malicious script on a remote server

MITRE ATT&CK

T1189 - Drive-by Compromise T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →