CuteNews remote PHP code injection execution vulnerability

Cutenews is a powerful news management system that uses flat-level file storage. Cutenews has a vulnerability in processing user-submitted request parameters. remote attackers may exploit this vulnerability to execute arbitrary commands on the host. When editing a template file, CuteNews cannot filter user input correctly. CuteNews obtains HTML code from Web forms and uses Cutenews as a powerful news management system that uses flat-level file storage.

Cutenews has a vulnerability in processing user-submitted request parameters. remote attackers may exploit this vulnerability to execute arbitrary commands on the host.

When editing a template file, CuteNews cannot filter user input correctly. CuteNews retrieves HTML code from the Web form and outputs it to . Tpl template file. The template package contains PHP code similar to the following:

-- Snip --
$ Template_active = < [HTML template code]
HTML;
$ Template_full = < [HTML template code]
HTML;
?>
-- Snap --

Enter the following template script:

-- Snip --
HTML;
[PHP code]
$ Fake_template = < -- Snap --

The administrator account can execute PHP code, causing shell commands to be executed in the local system.

<* Source: John Cantu (Jeian@myrealbox.com)

Link: http://marc.theaimsgroup.com /? L = bugtraq & m = 111773528322711 & w = 2
*>

Suggestion: Vendor patch:

CutePHP
-------
Currently, the vendor does not provide patches or upgrade programs. we recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Www.CutePHP.com.