Home page logo
/

bugtraq logo Bugtraq mailing list archives

CuteNews News.txt writable to world
From: e0r <socialanxiety () gmail com>
Date: 29 Aug 2004 08:39:34 -0000



Date: August 29, 2004
Vender: http://www.cutephp.com/
Program: CuteNews
Versions affected: => 1.3.6
Bug: CuteNews News.txt writable to world
Type: 
Author: e0r
        www: http://www.rootthief.com/
        team: !Sui-Generes (!Sui)
        Email: homicidal @ gmail . com
-----------------------------

Discription: 
Cute news is a powerful and easy for using news management system that use flat files to store its database. It 
supports comments, archives, search function, image uploading, backup function, IP banning, flood protection ...
----------------

Vulnerability:
 CuteNews is a very very popular news management system which makes this all the more serious. The folder "Data" is 
chmod '777', it has to be for CuteNews to work. But this poses a problem, if it is chmod 777 it means ANYONE can write 
to it. What makes it even worse is that the news.txt file is stored there, so anyone with local access to the file can 
open it up and replace something like:

||e0r|Open.|Many updates to come. For now, enojy the Forums.|||||

with

||!Sui|HACKED.|U got hexored!!1|||||

And now the vulnerable CuteNews is now defaced.


---------------

Fix: 
I haven't attempted to fix it, I'll leave that up to the vendor. 
---------------

Greets:  !Sui-Generis, #sui @ efnet, #blackhats,
           #phiral, atomix, d3thstar, m00, mgrd,
           lost-buffer, drug5t0r3, rootthief.com


  By Date           By Thread  

Current thread:
  • CuteNews News.txt writable to world e0r (Aug 30)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]