CuteNews remote PHP code injection vulnerability. Cutenews is a powerful news management system that uses flat-level file storage. Cutenews has a vulnerability in processing user submitted request parameters. remote attackers may exploit this vulnerability to use Cutenews as a powerful news management system that uses flat-level file storage.
Cutenews has a vulnerability in processing user-submitted request parameters. remote attackers may exploit this vulnerability to execute arbitrary commands on the host.
When editing a template file, CuteNews cannot filter user input correctly. CuteNews retrieves HTML code from the Web form and outputs it to . Tpl template file. The template package contains PHP code similar to the following:
-- Snip --
$ Template_active = < [HTML template code]
HTML;
$ Template_full = < [HTML template code]
HTML;
?>
-- Snap --
Enter the following template script:
-- Snip --
HTML;
[PHP code]
$ Fake_template = < -- Snap --
The administrator account can execute PHP code, causing shell commands to be executed in the local system.
<* Source: John Cantu (
Bytes. Cutenews has a vulnerability in processing user-submitted request parameters. remote attackers may exploit this vulnerability in...
