[34208] in bugtraq
Vulnerabilities in News Manager Lite 2.5 & News Manager Lite administration
daemon@ATHENA.MIT.EDU (Manuel Lopez)
Mon Mar 22 19:39:40 2004
Message-ID: <20040322201557.30671.qmail@gulo.org>
From: "Manuel Lopez" <mantra@gulo.org>
To: bugtraq@securityfocus.com
Date: Mon, 22 Mar 2004 21:15:57 +0100
Mime-Version: 1.0
Content-Type: text/plain; format=flowed; charset="iso-8859-15"
Content-Transfer-Encoding: 8bit
#Title: Vulnerabilities in News Manager Lite 2.5 & News Manager Lite
administration.
#Software: News Manager Lite 2.5 & News Manager Lite administration.
#Vendor: http://www.expinion.net/software/app_newsmanager.asp
#Impact: Disclosure of authentication information, Disclosure of user
information, Execution of arbitrary code via network, Modification of user
and admin information, User access via network.
#Underlying OS: Windows NT, Windows 2000, Windows 2003 or Windows XP
Professional/Server.
---- News Manager Lite 2.5 ----
#Vendor Description:
The Expinion News Manager Lite, makes it easy for you to keep your site's
news up-to-date. You can manage all your news items from an online
administration, and keep an archive of older news.
#Vulnerabilities:
This software has Multiple Flaws That Let Remote Users Hijack Admin Account,
Inject SQL Commands, and Conduct Cross-Site Scripting Attacks.
#Cross Site Scripting#
This product is vulnerable to the Cross-Site Scripting vulnerability that
would allow attackers to inject HTML and script codes into the pages and
execute it on the client's browser.
Examples:
http://[host]/comment_add.asp?ID=3&email=[XSS]
http://[host]/search.asp?search=[XSS]
http://[host]/category_news_headline.asp?ID=2&n=[XSS]
#SQL Injection#
Another problem could lead an attacker to inject SQL code to manipulate and
disclose various information from the database.
Examples:
http://[host]/more.asp?ID='[SQL query]
http://[host]/category_news.asp?ID='[SQL]
http://[host]/news_sort.asp?filter='[SQL]
---- News Manager Lite administration ----
#Cookie Account Hijack#
This issue can be exploited to gain an administrative account with the
service.
You can login like administrator modifying the cookie in this "way".
Example:
Cookie: NEWS%5FLOGIN=ADMIN=1&ID=1
#Solution:
Vendor contacted, the vulnerabilities will be addressed very soon.
#Credits:
Manuel López. mantra@gulo.org
