Home page logo
/

bugtraq logo Bugtraq mailing list archives

[eVuln] VNews Multiple Vulnerabilities
From: alex () evuln com
Date: 11 Apr 2006 17:09:52 -0000

New eVuln Advisory:
VNews Multiple Vulnerabilities
http://evuln.com/vulns/112/summary.html

--------------------Summary----------------
eVuln ID: EV0112
CVE: CVE-2006-1543 CVE-2006-1544 CVE-2006-1545
Software: VNews
Sowtware's Web Site: http://www.vscripts.pl/?id=vnews
Versions: 1.2
Critical Level: Dangerous
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)

-----------------Description---------------
1. SQL Injection.

Vulnerable scripts:
admin/admin.php
news.php

Parameters loginvar(admin/admin.php), news(news.php), nom(news.php) are not properly sanitized before being used in SQL 
queries. This can be used to evaluate arbitrary SQL expression(admin/admin.php) or make any SQL query by injecting 
arbitrary SQL code(news.php).

Condition: magic_quotes_gpc = off


2. Multiple Cross-Site Scripting.

Vulnerable Script: news.php

Parameters autorkomentarza, tresckomentarza are not properly sanitized. This can be used to post arbitrary HTML or web 
script code.


3. PHP Code Insertion.

Administrator has an ability to edit variable values from admin/config.php file. This can be used to insert arbitrary 
PHP code into config file which executes by every php-script.

System access is possible.

Condition: magic_quotes_gpc = off


--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/112/exploit.html

--------------Solution---------------------
No Patch available.

--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)


Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.


  By Date           By Thread  

Current thread:
  • [eVuln] VNews Multiple Vulnerabilities alex (Apr 11)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault