New eVuln Advisory: VNews Multiple Vulnerabilities http://evuln.com/vulns/112/summary.html --------------------Summary---------------- eVuln ID: EV0112 CVE: CVE-2006-1543 CVE-2006-1544 CVE-2006-1545 Software: VNews Sowtware's Web Site: http://www.vscripts.pl/?id=vnews Versions: 1.2 Critical Level: Dangerous Type: Multiple Vulnerabilities Class: Remote Status: Unpatched. No reply from developer(s) PoC/Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu (eVuln.com) -----------------Description--------------- 1. SQL Injection. Vulnerable scripts: admin/admin.php news.php Parameters loginvar(admin/admin.php), news(news.php), nom(news.php) are not properly sanitized before being used in SQL queries. This can be used to evaluate arbitrary SQL expression(admin/admin.php) or make any SQL query by injecting arbitrary SQL code(news.php). Condition: magic_quotes_gpc = off 2. Multiple Cross-Site Scripting. Vulnerable Script: news.php Parameters autorkomentarza, tresckomentarza are not properly sanitized. This can be used to post arbitrary HTML or web script code. 3. PHP Code Insertion. Administrator has an ability to edit variable values from admin/config.php file. This can be used to insert arbitrary PHP code into config file which executes by every php-script. System access is possible. Condition: magic_quotes_gpc = off --------------PoC/Exploit---------------------- Available at: http://evuln.com/vulns/112/exploit.html --------------Solution--------------------- No Patch available. --------------Credit----------------------- Discovered by: Aliaksandr Hartsuyeu (eVuln.com) Regards, Aliaksandr Hartsuyeu http://evuln.com - Penetration Testing Services .
