Description
PHP remote file inclusion vulnerability in impex/ImpExData.php in vBulletin ImpEx module 1.74, when register_globals is disabled, allows remote attackers to include arbitrary files via the systempath parameter.
References
- 20070504 Remote File Include In Script impex mailing-list
- 20060323 XOR Crew :: vBulletin ImpEx <= 1.74 - Remote Command Execution Vulnerability mailing-list
- ADV-2006-1056 vdb-entry
- 17206 vdb-entry
- impex-systempath-file-include(34095) vdb-entry
- 19352 third-party-advisory
- impex-impexdata-file-include(25391) vdb-entry
- 24070 vdb-entry