Description
PHP remote file inclusion vulnerability in CuteNews 1.3.6 and earlier allows remote attackers to execute arbitrary PHP code via the cutepath parameter to (1) show_archives.php or (2) show_news.php.
References
- 12432 third-party-advisory
- http://www.7a69ezine.org/node/view/130
- 20040830 RE: CuteNews News.txt writable to world mailing-list
- cutenews-file-include(17288) vdb-entry