This exploit demonstrates a Local File Inclusion (LFI) vulnerability in pHNews CMS Alpha 1. It provides URLs that can be used to include arbitrary local files via the 'templates_dir' and 'template' parameters in the 'comments.php' module.
Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target:pHNews CMS Alpha 1
No auth needed
Prerequisites:Target must have pHNews CMS Alpha 1 installed · Register Globals must be enabled