Mcnews · Mcnews · CVE-2005-0800
**Name of the Vulnerable Software and Affected Versions**
mcNews versions 1.3 and earlier
**Description**
The issue allows remote attackers to execute arbitrary PHP code by modifying the `l` parameter to reference a URL on a remote web server that contains the code.
**Recommendations**
For mcNews versions 1.3 and earlier, consider restricting access to the install.php file until a patch is available. As a temporary workaround, avoid using the `l` parameter in the install.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.