CuteNews Discloses Web Server Information to Remote Users
|
|
SecurityTracker Alert ID: 1008339
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Dec 1 2003
|
Impact: Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1.3
|
Description: Arnaud Jacques of securiteinfo.com reported an information disclosure vulnerability in CuteNews. A remote user can determine information about the target web server.
It is reported that a remote user can request a URL for the 'index.php' script in debug mode to cause CuteNews to display the typical
'phpinfo' page.
A demonstration exploit URL is provided:
http://[target]/cutenews/index.php?debug
The vendor has reportedly
been notified.
|
Impact: A remote user can determine information about the web server and PHP environment.
|
Solution: No solution was available at the time of this entry.
The author of the report suggests that, as a workaround, you can delete the following line from your index.php file:
if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
|
Vendor URL: cutephp.com/cutenews/index.php (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: scrap <webmaster@securiteinfo.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 30 Nov 2003 22:07:38 +0100
From: scrap <webmaster@securiteinfo.com>
Subject: Cutenews 1.3 information disclosure
|
.oO Overview Oo.
Cutenews 1.3 information disclosure
Discovered on 2003, July, 12th
Vendor: CutePHP
Cutenews is a powerful and easy for using news management system that use flat
files to store its database. It supports comments and archives, search
function, image uploading, backup function, IP banning, flood protection ...
Mainely, the first job a hacker does, is to retreive a maximum of information
from the target server. Cutenews can help much in this task.
For more information, I suggest you to read "phpinfo() et la sécurité" by
frog-m@n (french document) at
http://www.phpsecure.info/v2/article/Phpinfo-Security.php
.oO Details Oo.
In the file index.php, a condition can be made to execute the PHP function
phpinfo(); Here is the interesting lines :
if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
...
function debug(){
global $config_version_name, $config_version_id, $config_http_script_dir;
echo"<center><b>CuteNews Debug Information:</b><hr><br>";
echo"Script Version/ID: $config_version_name / $config_version_id<br>";
echo"\$config_http_script_dir: $config_http_script_dir<br><BR>";
echo"<hr>";
phpinfo();
exit();
.oO Exploit Oo.
The exploit is really easy : Give the debug argument to the index.php :
http://victim.com/cutenews/index.php?debug
You will get the classical phpinfo page.
.oO Solution Oo.
We suggest to delete the following line from your index.php file :
if($HTTP_SERVER_VARS['QUERY_STRING'] == "debug"){ debug(); }
The vendor has been informed.
.oO Discovered by Oo.
Arnaud Jacques aka scrap
webmaster@securiteinfo.com
http://www.securiteinfo.com
|
|
