high7.5Public exploit code
CVE-2005-0859
PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to (1) headlines.php or…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CzarNews 1.13/1.14 - 'headlines.php' Remote File Inclusion2005-03-21 · webapps · php · Verified
- CzarNews 1.14 - 'tpath' Remote File Inclusion2006-07-13 · webapps · php · Verified
Impact
PHP remote file inclusion vulnerability in CzarNews 1.13b allows remote attackers to execute arbitrary PHP code via the tpath parameter to (1) headlines.php or (2) news.php. NOTE: some sources have reported the "dir" parameter as being affected; however, this is likely a cut-and-paste error from the wrong section of the original vulnerability report. Also, the news.php version was later reported to be in 1.12 through 1.14.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Czaries Network | Czarnews | Version 1.13b |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/14670
- http://securitytracker.com/id?1013486
- http://www.osvdb.org/14925
- http://www.osvdb.org/14926
- http://www.securityfocus.com/bid/12857
- http://www.securityfocus.com/bid/18411
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19765
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27733
- https://www.exploit-db.com/exploits/2009
- http://secunia.com/advisories/14670
- http://securitytracker.com/id?1013486
- http://www.osvdb.org/14925
- http://www.osvdb.org/14926
- http://www.securityfocus.com/bid/12857
- http://www.securityfocus.com/bid/18411
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19765
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27733
- https://www.exploit-db.com/exploits/2009