CVE Vulnerabilities

CVE-2004-1796

Published: Dec 31, 2004 | Modified: Jul 11, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

PHP remote file inclusion vulnerability in HotNews 0.7.2 and earlier allows remote attackers to execute arbitrary PHP code via the (1) config[header] parameter to hotnews-engine.inc.php3 or (2) config[incdir] parameter to hnmain.inc.php3.

Affected Software

Name Vendor Start Version End Version
Hotnews Hotnews 0.5.3 0.5.3
Hotnews Hotnews 0.6.0 0.6.0
Hotnews Hotnews 0.6.0_pre 0.6.0_pre
Hotnews Hotnews 0.6.1 0.6.1
Hotnews Hotnews 0.7.0 0.7.0
Hotnews Hotnews 0.7.1 0.7.1
Hotnews Hotnews 0.7.2 0.7.2

References