Description
Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.
References
- 20011002 results of semi-automatic source code audit mailing-list
- php-includedir-code-execution(7215) vdb-entry
- VU#847803 third-party-advisory
- 3386 vdb-entry
- http://www.kb.cert.org/vuls/id/JARL-53RJKV
- http://www.come.to/zorbat/