Description
PHP remote file inclusion vulnerability in admin/includes/spaw/dialogs/insert_link.php in download engine (Download-Engine) 1.4.1 allows remote authenticated users to execute arbitrary PHP code via a URL in the spaw_root parameter, a different vector than CVE-2007-2255. NOTE: this may be an issue in SPAW.
References
- 20070425 download engine V1.4.1 >> RFI (local) mailing-list
- 35401 vdb-entry
- downloadengine-insertlink-file-include(33918) vdb-entry