Core News Index.PHP Remote Code Execution Vulnerability

Bugtraq ID:	17067
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 10 2006 12:00AM
Updated:	Mar 13 2006 06:45PM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	CoreNews CoreNews 2.0.1
Not Vulnerable:

Core News Index.PHP Remote Code Execution Vulnerability

Core News is prone to a code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Core News version 2.0.1. is vulnerable; other versions may also be affected.

Core News Index.PHP Remote Code Execution Vulnerability


This issue can be exploited via a web client.


An example URI has been provided:

http://www.example.com/index.php?page=evilcode?&cmd=id

Core News Index.PHP Remote Code Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]

Core News Index.PHP Remote Code Execution Vulnerability

References:

• CoreNews Web Site (CoreNews)
  
• CoreNews 2.0.1 Remote Command Exucetion ([email protected])