PHPNews.Change_Action.PHP.File.Inclusion

Release Date Sep 07, 2007
Severity low
Impact System compromise, remote script execution.
Description Andreas Robertz PHPNews has a remote file inclusion vulnerability. A remote attacker could execute arbitrary scripts on a web server with the privileges of the server via a specially crafted URL request to the 'admin/inc/change_action.php' script, by using the 'format_menue' parameter to specify a malicious PHP file from a remote system.
Affected Products CreAr PHPNews version 0.93 and prior.
Recommended Actions Currently we are not aware of any official fix for this issue.
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2007-4232
Reference/s http://www.securityfocus.com/bid/25223 (BugTraq)

Fortinet