News

Those variables where `extracted' (extract()) from the global variables, but the problem itself is that they're not filtered. So here we can see that the following variables allow html injection arbitrary code: $user, $story, $title. 2 - [ Full Path Disclosure ] In /inc/ folder, there're 2 .php files that don't check if they're been called directly. - Proof of concept --------------------------------------------------------------- 1 - [ Cross site scripting ] As PoC, here you've some intresting results: - search.php?dosearch=yes&story=%22%3E%3Cscript%3Ealert %28%22NST+PoC+by+K4P0%22%29%3B%3C%2Fscript%3E&title=& user=&from_date_day=&from_date_month=&from_date_year=& to_date_day=&to_date_month=&to_date_year= - search.php?dosearch=yes&title=%22%3E%3Cscript%3Ealert (%22NST%20PoC%20by%20K4P0%22 );%3C/script%3E&user= &from_date_day=&from_date_month=&from_date_year= &to_date_day =&to_date_month=&to_date_year= - search.php?dosearch=yes&story=K4P0&user=%22%3E%3Cscript%3 Ealert(%22NST%20PoC%20by%20K4P0%22);%3C/script%3E&from_date_day= &from_date_month=&from_date_year=&to_date_day=&to_date_month= &to_date_year= - search.php?dosearch=yes&title=">&user=&from_date_day= &from_date_month=&from_date_year=&to_date_day=&to_date_month= &to_date_year= Note: magic_quotes_gpc must be off 2 - [ Full path disclosure ] www.victim.com/cutenews/inc/show.inc.php www.victim.com/cutenews/inc/functions.inc.php - Solutions --------------------------------------------------------------- It's highly recommended to uptdate your CuteNews, but if you want to patch it yourself take a look at the following recommendations: 1 - [ Cross site scripting ] Set magic_quotes_gpc ON in your php.ini, but as this cannot be possible in serveral servers (hosting stuff), the real solution is to filter these variables. Go to line 25 and change it to this: // Show Search Form $user = htmlentities($user); $story = htmlentities($story); $title = htmlentities($title); echo<< function mySelect(form){ form.select(); } function ShowOrHide(d1, d2) { if (d1 != '') DoDiv(d1); if (d2 != '') DoDiv(d2); } 2 - [ Full Path Disclosure ] In the first line of 'functions.inc.php' write: if (eregi('functions.inc.php', $_SERVER['PHP_SELF'])) die('You are not allowed to see this page directly'); In the first line of 'shows.inc.php' write: if (eregi('shows.inc.php', $_SERVER['PHP_SELF'])) die('You are not allowed to see this page directly'); - Timeline --------------------------------------------------------------- 03/03/2006 - Vendor was notified about security issues *** - Vendor did not reply but released a newer version. - Discalimer --------------------------------------------------------------- YOU are the only RESPONSALBE of any DAMAGE of above techniques could cause or any code you have made based in this advisory, all ideas, proof of concepts, solutions, descriptions were made only for EDUCATIONAL propuses, use all above information at your own risk. - References --------------------------------------------------------------- http://NeoSecurityTeam.net/index.php?action=advisories&id=20 http://NeoSecurityTeam.net/advisories/Advisory-20.txt - Credits --------------------------------------------------------------- Discovered by k4p0 -> k4p0k4p0[at]hotmail[dot]com [N]eo [S]ecurity [T]eam [NST]Ž - http://NeoSecurityTeam.net/ Irc.FullNnetwork.org #nst Questions? (Eng | Spa) -> http://NeoSecurityTeam.net/foro/ - Greets --------------------------------------------------------------- Paisterist HaCkZaTaN Link Daemon21 erg0t NST Comunity! @@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@ '@@@@@''@@'@@@''''''''@@''@@@''@@ '@@'@@@@@@''@@@@@@@@@'''''@@@'''' '@@'''@@@@'''''''''@@@''''@@@'''' @@@@''''@@'@@@@@@@@@@''''@@@@@''' */

Title

Author