CGIScript.net csNews Header File Type Restriction Bypass Vulnerability

Bugtraq ID:	4994
Class:	Input Validation Error
CVE:	CVE-2002-0923
Remote:	Yes
Local:	No
Published:	Jun 11 2002 12:00AM
Updated:	Jul 11 2009 01:56PM
Credit:	Discovery is credited to Steve Gustin <[email protected]>.
Vulnerable:	CGISCRIPT.NET csNews Professional 1.0 - Apache Apache 1.3.24 - Apache Apache 1.3.23 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 CGISCRIPT.NET csNews 1.0
Not Vulnerable:

CGIScript.net csNews Header File Type Restriction Bypass Vulnerability

csNews is a script for managing news items on a website. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

It is possible for a malicious admin user to bypass file type restrictions on the header and footer file. This may result in arbitrary system files being displayed to remote users, and the disclosure of sensitive information.

The ability to exploit this vulnerability may only require "public" access to csNews if used in conjunction with issues discussed in BID 4993.

CGIScript.net csNews Header File Type Restriction Bypass Vulnerability

The following sample exploit has been contributed by Steve Gustin <[email protected]>.

javascript:alert(document.form1.pheader.value='setup.cgi');

CGIScript.net csNews Header File Type Restriction Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CGIScript.net csNews Header File Type Restriction Bypass Vulnerability

References:

• BID: 4993 CGIScript.net csNews Double URL Encoding Unauthorized Administrative A (SecurityFocus)
  
• CGISCRIPT.NET Homepage (CGISCRIPT.NET)