CVE:CVE-2008-1609
CNNVD:CNNVD-200804-008
just another flat file (JAF) CMS 4.0 RC2存在多个PHP远程文件包含漏洞。远程攻击者通过网站URL参数(a)forum.php,(b)headlines.php和(c)main.php，以及发送到forum/forum.php的main_dir，执行任意的PHP代码。
solution:Upgrade jaf_cms jaf_cms to a higher version than 4.0_rc2,and avoid the version 4.0_rc2