csNews 1.0 Header File Type Restriction Bypass Vulnerability

ID EDB-ID:21533
Type exploitdb
Reporter Steve Gustin
Modified 2002-06-11T00:00:00

Description csNews 1.0 Header File Type Restriction Bypass Vulnerability. CVE-2002-0923. Webapps exploit for cgi platform


csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

It is possible for a malicious admin user to bypass file type restrictions on the header and footer file. This may result in arbitrary system files being displayed to remote users, and the disclosure of sensitive information.

The ability to exploit this vulnerability may only require "public" access to csNews if used in conjunction with issues discussed in BID 4993.