Multiple Vulnerabilities in VNews

Summary

Vulnerability
Multiple Vulnerabilities in VNews
Discovered
2006.03.29
Last Update
2006.04.09 Exploitation code published
ID
EV0112
CVE
CVE-2006-1543 CVE-2006-1544 CVE-2006-1545
Risk Level
high
Type
Multiple Vulnerabilities
Status
Unpatched. No reply from developer(s)
Vendor
n/a
Vulnerable Software
VNews (http://www.vscripts.pl/?id=vnews)
Version
1.2
PoC/Exploit
Available
Solution
Not available
Discovered by
Aliaksandr Hartsuyeu (eVuln.com)

Description

Multiple Vulnerabilities found in VNews (http://www.vscripts.pl/?id=vnews) script.

1. SQL Injection.

Vulnerable scripts:
admin/admin.php
news.php

Parameters loginvar(admin/admin.php), news(news.php), nom(news.php) are not properly sanitized before being used in SQL queries. This can be used to evaluate arbitrary SQL expression(admin/admin.php) or make any SQL query by injecting arbitrary SQL code(news.php).

Condition: magic_quotes_gpc = off


2. Multiple Cross-Site Scripting.

Vulnerable Script: news.php

Parameters autorkomentarza, tresckomentarza are not properly sanitized. This can be used to post arbitrary HTML or web script code.


3. PHP Code Insertion.

Administrator has an ability to edit variable values from admin/config.php file. This can be used to insert arbitrary PHP code into config file which executes by every php-script.

System access is possible.

Condition: magic_quotes_gpc = off

PoC/Exploit

SQL Injection Example1:

URL: http://[host]/vnews/admin/admin.php
login: ' and [sql_expression]/*


SQL Injection Example2:

http://[host]/vnews/news.php?co=show&news=99'%20union%20select%201,2,3,4,5,6/*&nom=1


Cross-Site Scripting Example:

URL: http://[host]/vnews/news.php?co=show&news=2&nom=1
Autor: [XSS]
Tresc: [XSS]


PHP Code Insertion Example:

URL: http://[host]/vnews/admin/admin.php?k=config
tlo: #BCCBCD"; [php_code] $aa="

Solution.

Solution for "Multiple Vulnerabilities in VNews" is not available. Check vendor's website for updates.