CuteNews and UTF-8 CuteNews Multiple Security Vulnerabilities

Bugtraq ID:	36971
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 10 2009 12:00AM
Updated:	Nov 12 2009 07:46PM
Credit:	Andrew Horton from MorningStar Security
Vulnerable:	UTF-8 CuteNews UTF-8 CuteNews UTF-8 CutePHP CuteNews 1.4.6
Not Vulnerable:	UTF-8 CuteNews UTF-8 CuteNews UTF-8b

CuteNews and UTF-8 CuteNews Multiple Security Vulnerabilities

CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues.

Note that exploits for some of the issues may require administrator privilege.

Successful exploits may allow attackers to:
- obtain sensitive information
- gain unauthorized access to the affected application
- run arbitrary script code in the browser of an unsuspecting user in the context of the affected site
- hijack user sessions
- execute arbitrary commands in the context of the webserver process

A successful attack will compromise the application and may aid in further attacks.

CuteNews and UTF-8 CuteNews Multiple Security Vulnerabilities

An attacker can exploit these issues through a browser. To exploit the cross-site scripting issue, the attacker must entice an unsuspecting user to visit a malicious site.

The following example URIs and data are available:

• /data/vulnerabilities/exploits/36971.txt

CuteNews and UTF-8 CuteNews Multiple Security Vulnerabilities

Solution:
These issues are reported to be addressed in UTF-8 CuteNews 8b. Please see the references for more information.

CuteNews and UTF-8 CuteNews Multiple Security Vulnerabilities

References:

• CuteNews Homepage (Cutephp)
  
• UTF-8 CuteNews Homepage (UTF-8 CuteNews)
  
• [MORNINGSTAR-2009-02] Multiple security issues in Cute News and UTF-8 Cute News (Andrew Horton )