---------------------------------------------------------------------- Looking for a job? Secunia is hiring skilled researchers and talented developers. http://secunia.com/company/jobs/ ---------------------------------------------------------------------- TITLE: Xinha Configuration Variable Overwrite Vulnerabilities SECUNIA ADVISORY ID: SA39782 VERIFY ADVISORY: http://secunia.com/advisories/39782/ DESCRIPTION: Stefan Esser has discovered some vulnerabilities in Xinha, which can be exploited by malicious people to compromise a vulnerable system. The vulnerabilities are caused due to errors in the processing of configuration variables e.g. within config.inc.php for the "ImageManager" and the "ExtendedFileManager" plugins. These can be exploited to overwrite certain configuration variables and e.g. upload and execute arbitrary PHP code to an affected system. The vulnerabilities are confirmed in version 0.95. Other versions may also be affected. SOLUTION: Restrict network access to the application to trusted users (e.g. via an .htaccess file). PROVIDED AND/OR DISCOVERED BY: Stefan Esser ORIGINAL ADVISORY: http://php-security.org/2010/05/10/mops-2010-020-xinha-wysiwyg-plugin-configuration-injection-vulnerability/index.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------