Overview
Cutenews 1.3 information disclosure
Discovered on 2003, July, 12th
Vendor:
CutePHP
Product :
Cutenews
Cutenews is a powerful and easy for using news management system that use flat files to store its database. It supports comments and archives, search function, image uploading, backup function, IP banning, flood protection ...
Mainely, the first job a hacker does, is to retreive a maximum of information from the target server. Cutenews can help much in this task.
For more information, I suggest to read
phpinfo() et la sécurité by frog-m@n (french document).
Risk
| Exploit easiness |
 |
| Vulnerability spreading |
 |
| Impact |
|
| Risk |
|
Details
In the file
index.php, a condition can be made to execute the PHP function
phpinfo();
Here is the interesting lines :
if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
...
function debug(){
global $config_version_name, $config_version_id, $config_http_script_dir;
echo"<center><b>CuteNews Debug Information:</b><hr><br>";
echo"Script Version/ID: $config_version_name / $config_version_id<br>";
echo"\$config_http_script_dir: $config_http_script_dir<br><BR>";
echo"<hr>";
phpinfo();
exit();
}
Exploit
The exploit is really easy : Give the debug argument to the index.php :
http://victim.com/cutenews/index.php?debug
You will get the classical phpinfo page :
Solution
We suggest to delete the following line from your index.php file :
if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
The vendor has been informed.
Discovered by
Arnaud Jacques aka scrap
webmaster@securiteinfo.com
Tags
RECHERCHE DE VULNERABILITÉS
SERVEUR WEB
TECHNOLOGIES WEB
FUITE D'INFORMATIONS
Inscription à notre lettre d'information
Inscrivez-vous à notre
lettre d'information pour vous tenir au courant de nos actualités et de nos dernières trouvailles.
