bugtraq - [VulnDiscuss] Cutenews 1.3 information disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200311302207.38157.webmaster@securiteinfo.com>
Date: Sun, 30 Nov 2003 22:07:38 +0100
From: scrap <webmaster@...uriteinfo.com>
To: bugtraq@...urityfocus.com,
 full-disclosure@...ts.netsys.com
Cc: admin@...curit.com,
 bugs@...uritytracker.com,
 news@...uriteam.com,
 submissions@...ketstormsecurity.org,
 ts@...urityoffice.net,
 vuln@...urity-corporation.com,
 vulnwatch@...nwatch.org
Subject: [VulnDiscuss] Cutenews 1.3 information disclosure

.oO Overview Oo.

Cutenews 1.3 information disclosure
Discovered on 2003, July, 12th
Vendor: CutePHP

Cutenews is a powerful and easy for using news management system that use flat 
files to store its database. It supports comments and archives, search 
function, image uploading, backup function, IP banning, flood protection ...
Mainely, the first job a hacker does, is to retreive a maximum of information 
from the target server. Cutenews can help much in this task.
For more information, I suggest you to read "phpinfo() et la sécurité" by 
frog-m@n (french document) at 
http://www.phpsecure.info/v2/article/Phpinfo-Security.php

.oO Details Oo.

In the file index.php, a condition can be made to execute the PHP function 
phpinfo(); Here is the interesting lines :

if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
...
function debug(){
   global $config_version_name, $config_version_id, $config_http_script_dir;
   echo"<center><b>CuteNews Debug Information:</b><hr><br>";
   echo"Script Version/ID:  $config_version_name / $config_version_id<br>";
   echo"\$config_http_script_dir:  $config_http_script_dir<br><BR>";
   echo"<hr>";
   phpinfo();

exit();
}

.oO Exploit Oo.

The exploit is really easy : Give the debug argument to the index.php :

http://victim.com/cutenews/index.php?debug

You will get the classical phpinfo page.

.oO Solution Oo.

We suggest to delete the following line from your index.php file :

if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }

The vendor has been informed.

.oO Discovered by Oo.

Arnaud Jacques aka scrap
webmaster@...uriteinfo.com
http://www.securiteinfo.com