CVE-2012-1933

Description

Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsiteDir] parameter to (1) include/phorum_load.php, (2) conf/install_conf.php, or (3) conf/liveuser_configuration.php.

Weakness classification

• CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references

• cve@mitre.org — Exploit
• cve@mitre.org — Exploit
• cve@mitre.org — Vendor Advisory
• cve@mitre.org — Exploit
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org
• cve@mitre.org — Exploit
• af854a3a-2127-422b-91ae-364da2661108 — Exploit
• af854a3a-2127-422b-91ae-364da2661108 — Exploit
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit