New eVuln Advisory:
VNews Multiple Vulnerabilities
http://evuln.com/vulns/112/summary.html
--------------------Summary----------------
eVuln ID: EV0112
CVE: CVE-2006-1543 CVE-2006-1544 CVE-2006-1545
Software: VNews
Sowtware's Web Site: http://www.vscripts.pl/?id=vnews
Versions: 1.2
Critical Level: Dangerous
Type: Multiple Vulnerabilities
Class: Remote
Status: Unpatched. No reply from developer(s)
PoC/Exploit: Available
Solution: Not Available
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
-----------------Description---------------
Vulnerable scripts:
admin/admin.php
news.php
Parameters loginvar(admin/admin.php), news(news.php), nom(news.php) are not properly sanitized before being used in SQL queries. This can be used to evaluate arbitrary SQL expression(admin/admin.php) or make any SQL query by injecting arbitrary SQL code(news.php).
Condition: magic_quotes_gpc = off
Vulnerable Script: news.php
Parameters autorkomentarza, tresckomentarza are not properly sanitized. This can be used to post arbitrary HTML or web script code.
Administrator has an ability to edit variable values from admin/config.php file. This can be used to insert arbitrary PHP code into config file which executes by every php-script.
System access is possible.
Condition: magic_quotes_gpc = off
--------------PoC/Exploit----------------------
Available at: http://evuln.com/vulns/112/exploit.html
--------------Solution---------------------
No Patch available.
--------------Credit-----------------------
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)
Regards,
Aliaksandr Hartsuyeu
http://evuln.com - Penetration Testing Services
.