Release Date: 2004-01-06
Critical: Highly critical
Impact: System access
Where: From remote
Software: HotNews 0.x
Description:
Officerrr has identified a vulnerability in HotNews, allowing malicious people to compromise a vulnerable system.
The problem is that the include files "hnmain.inc.php3" and "hotnews-engine.inc.php3" don't verify the "config["header"]" and "config["incdir"]" parameters properly. This can be exploited to include arbitrary PHP code from local and external resources.
The vulnerability has been confirmed in 0.7.2. Prior versions may also be affected.
Solution:
Protect the "includes" directory with .htaccess or similar.
Edit the source code to ensure that input is properly verified or paths to include files are set to fixed values.
Provided and/or discovered by:
Dariusz 'Officerrr' Kolasinski
Source: Secunia