Signature Detail

HTTP: phpMyNewsletter Insecure File Include

This signature detects attempts to exploit a known vulnerability in phpMyNewsletter. Version 0.6.10 and earlier are vulnerable. phpMyNewsletter does not verify the legitimacy of files included in the customize.php script using the l parameter. Attackers can include a malicious remote file in the customize.php script to execute arbitrary commands on the host.

Extended Description

Remote attackers could exploit this vulnerability to view files on an affected server, or to execute arbitrary commands within the security context of the phpMyNewsLetter process.

References

• URL: http://securityvulns.com/docs3583.html
• URL: http://www.net-security.org/vuln.php?id=2419
• URL: http://www.securiteam.com/unixfocus/6U0011P5QQ.html