----------------------------------------------------------------------


Looking for a job?


Secunia is hiring skilled researchers and talented developers.


http://secunia.com/company/jobs/


----------------------------------------------------------------------

TITLE:
Xinha Configuration Variable Overwrite Vulnerabilities

SECUNIA ADVISORY ID:
SA39782

VERIFY ADVISORY:
http://secunia.com/advisories/39782/

DESCRIPTION:
Stefan Esser has discovered some vulnerabilities in Xinha, which can
be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities are caused due to errors in the processing of
configuration variables e.g. within config.inc.php for the
"ImageManager" and the "ExtendedFileManager" plugins. These can be
exploited to overwrite certain configuration variables and e.g.
upload and execute arbitrary PHP code to an affected system.

The vulnerabilities are confirmed in version 0.95. Other versions may
also be affected.

SOLUTION:
Restrict network access to the application to trusted users (e.g. via
an .htaccess file).

PROVIDED AND/OR DISCOVERED BY:
Stefan Esser

ORIGINAL ADVISORY:
http://php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------