Bill

**Name of the Vulnerable Software and Affected Versions** Jetbox CMS version 2.1 **Description** The issue concerns a remote file inclusion vulnerability. It allows remote attackers to execute arbitrary PHP code via a URL in the `relative script path` parameter. This is a different vector from a previously reported issue. However, it is noted that this issue has been disputed, and as of 20060830, the analysis concurs with the dispute, suggesting the vulnerability might actually be in a third-party module, phpDig 1.8.8. **Recommendations** For Jetbox CMS version 2.1, consider restricting access to the `includes/phpdig/libs/search function.php` file until the issue is resolved. As a temporary workaround, avoid using the `relative script path` parameter in affected URLs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.