cutenews 1.4.1 Arbitrary File Access

cutenews 1.4.1 Arbitrary File Access

Cute news is a powerful and easy for using news
management system that use flat files to store its
database.
It supports comments, archives, search function, image
uploading, backup function, IP banning, flood
protection …
http://cutephp.com

Credit:
The information has been provided by Hamid Ebadi
( Hamid Network Security Team) : admin[AT]hamid[o]ir.
The original article can be found at :
http://hamid.ir/security

Input passed to the "archive" (POST,COOKIE,… method)
parameter in "inc/function.php" isn't properly
verified.
This can be exploited to access arbitrary files (like
users.db.php and config.php).

Vulnerable Systems:
cutenews 1.4.1 and below

Vulnerable Code:
The following lines in $cutepath/inc/functions.inc.php
on line 7

if( isset($_GET['archive']) and $_GET['archive'] != ""
and !eregi("^[_a-zA-Z0-9-]{1,}$", $_GET['archive'])){
die("invalid archive characters"); }

here you can see cutenews just filter
$_GET['archive'] but they forgot $_POST['archive'],
$COOKIE['archive']! and in the rest of code they user
$archive instead of $_GET['archive'] !!!?
for example :

if($archive == ""){
$news_file = "$cutepath/data/news.txt";
$comm_file = "$cutepath/data/comments.txt";
}else{
$news_file =
"$cutepath/data/archives/$archive.news.arch";
$comm_file =
"$cutepath/data/archives/$archive.comments.arch";
}
…

Successful exploitation requires that
"register_globals" is enabled.

Path Disclosure :
if an attacker provides a filename which not exists,
the application will return some information about
path of cutenews on the server, like this:
Warning:
file([PATH]/cutenews/data/archives/hamid.news.arch):
failed to open stream: No such file or directory in
[PATH]\cutenews\inc\shows.inc.php on line 583

Unofficial Patch:
line 8 : inc/functions.inc.php
if( isset($archive) and $archive != "" and
!eregi("^[_a-zA-Z0-9-]{1,}$", $archive)){ die("Patched
by Hamid Ebadi –>http://hamid.ir ( Hamid Network
Security Team) "); }
if( isset($_REQUEST['archive']) and
$_REQUEST['archive'] != "" and
!eregi("^[_a-zA-Z0-9-]{1,}$", $_REQUEST['archive'])){
die("Patched by Hamid Ebadi –>http://hamid.ir (
Hamid Network Security Team) "); }

Exploit:
http://hamid.ir/exploit/

Signature

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com