PHPNuke AddOn PHPToNuke Allows Remote File Retrieving 
Oct, 17 2002 - 10:07
contributed by: hx
Summary 
phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios. A security vulnerability in the PHP allows attackers to cause the script to display the content of arbitrary files (Files residing outside the normally bound HTML root directory).


Details 
Exploit:
By accessing the following URL:
http://website.com/phptonuke.php?filnavn=/etc/passwd

It is possible to cause the remote server to return the content of the /etc/passwd file.


Additional information 
The information has been provided by Zero X