Cute news is a powerful and easy for using news management system that use flat files to store its database. It supports comments, archives, search function, image uploading, backup function, IP banning, flood protection ...
----------------
>Vulnerability:
CuteNews is a very very popular news management system which makes this all the more serious. The folder "Data" is chmod '777', it has to be for CuteNews to work. But this poses a problem, if it is chmod 777 it means ANYONE can write to it. What makes it even worse is that the news.txt file is stored there, so anyone with local access to the file can open it up and replace something like:
||e0r|Open.|Many updates to come. For now, enojy the Forums.|||||
with
||!Sui|HACKED.|U got hexored!!1|||||
And now the vulnerable CuteNews is now defaced.
---------------
>Fix:
I haven't attempted to fix it, I'll leave that up to the vendor.
Date: August 29, 2004
Vender: http://www.cutephp.com/
Program: CuteNews
Versions affected: => 1.3.6
Bug: CuteNews News.txt writable to world
Type:
Author: e0r
www: http://www.rootthief.com/
team: !Sui-Generes (!Sui)
Email: homicidal @ gmail . com
-----------------------------
>Discription:
Cute news is a powerful and easy for using news management system that use flat files to store its database. It supports comments, archives, search function, image uploading, backup function, IP banning, flood protection ...
----------------
>Vulnerability:
CuteNews is a very very popular news management system which makes this all the more serious. The folder "Data" is chmod '777', it has to be for CuteNews to work. But this poses a problem, if it is chmod 777 it means ANYONE can write to it. What makes it even worse is that the news.txt file is stored there, so anyone with local access to the file can open it up and replace something like:
||e0r|Open.|Many updates to come. For now, enojy the Forums.|||||
with
||!Sui|HACKED.|U got hexored!!1|||||
And now the vulnerable CuteNews is now defaced.
---------------
>Fix:
I haven't attempted to fix it, I'll leave that up to the vendor.
---------------
>Greets: !Sui-Generis, #sui @ efnet, #blackhats,
#phiral, atomix, d3thstar, m00, mgrd,
lost-buffer, drug5t0r3, rootthief.com
[ reply ]