Description
Direct static code injection vulnerability in admin/config.php in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allows remote authenticated administrators to execute code by inserting the code into variables that are stored in admin/config.php.
References
- 24276 vdb-entry
- 20060411 [eVuln] VNews Multiple Vulnerabilities mailing-list
- 19435 third-party-advisory
- ADV-2006-1173 vdb-entry
- http://www.evuln.com/vulns/112
- vnews-config-file-include(25531) vdb-entry