[原文]PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parameter to (1) backend.php, (2) screen.php, or (3) admin/modules/comment.php.
News Evolution is a freely available, open source news software package. It is written in PHP, and designed for use on Unix and Linux operating systems.
The problem occurs in the aff_news.php file. By loading this file, and defining the chemin variable to an arbitrary location, commands can be executed on the local host. This vulnerability may also be used to reveal sensitive information on the local host. This same vulnerability also occurs in the export_news.php file.
News Evolution contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the 'back-end.php' script not properly sanitizing user input supplied to the 'neurl' parameter. This may allow an attacker to include a file from a third-party remote host that contains commands or code that will be executed by the vulnerable script with the same privileges as the web server.