Vulnerability in Php Arena Panews

CVE-2005-0647

admin_setup.php in paNews 2.0.4b allows remote attackers to inject arbitrary PHP code via the (1) $form[comments] or (2) $form[autoapprove] parameters, which are written to config.php.

EPSS: 0.042 (89.8th percentile) — read the EPSS interpretation.

Affected products

Php_arena Panews — versions 2.0.4b
N/a — versions n/a

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)