PTNews v1.7.7 - Access to administrator functions without authentificatio=
n


=2EoO Overview Oo.
PTNews v1.7.7 - Access to administrator functions without authentificatio=
n
Discovered on 2003, April, 7th
Vendor: PTNews - http://www.openbg.net/ptsite/

PT News is a simple news system. This is lite solution for sites without =
SQL=20
database support. Whole system is written in PHP (PHP3 and PHP4 support).
A vulnerability allows to access to the administrator functions, without=20
authentification.=20


=2EoO Details Oo.
In PTNews v1.7.7, administrator functions are located in the file news.in=
c
Here is the interesting piece of code :

//handle administrator functions

$files =3D getFileNames($newsdir);
$context =3D "";

if ($HTTP_POST_VARS[submitButton] =3D=3D $lang[frm_btn]) {
createNewsEntry($newsdir);
if ("replace" =3D=3D $HTTP_POST_VARS[action] &&
in_array($HTTP_POST_VARS[file], $files)) {
deleteNewsEntry($newsdir.$HTTP_POST_VARS[file]);
}
makeNewsRSS($newsdir);
} elseif (isset($HTTP_GET_VARS[delete])) {
if ("all" =3D=3D $HTTP_GET_VARS[delete]) {
$context =3D deleteAll($newsdir,$config[newssuff]);
} else {
if (in_array($HTTP_GET_VARS[delete], $files))
deleteNewsEntry ($newsdir.$HTTP_GET_VARS[delete]);
}
makeNewsRSS($newsdir);
} elseif (isset($HTTP_GET_VARS[edit]) &&
in_array($HTTP_GET_VARS[edit], $files)) {
$context =3D editNewsEntry($newsdir,$HTTP_GET_VARS[edit]);
}


As you can see, it can handle :=20
- News creation
- News replacement
- News deletion
- News editing


Now, the file "news.inc" is included in the index.php file as followed :

<html>
<head>
<title>PTNews Site</title>
</head>
<body>
<?
$newsdir =3D "news/";
include ("news.inc");
// handle CGI parameters
if (!isset($HTTP_GET_VARS[pageNum])) $pageNum =3D 1;
else $pageNum =3D $HTTP_GET_VARS[pageNum];
if (!isset($HTTP_GET_VARS[topic])) {
$topic=3D"";
} else {
$topic=3D$HTTP_GET_VARS[topic];
}
$extra=3D"";
?>
etc...


Bingo ! File "news.inc" is needed for the public access file "index.php",=
for=20
example for the "searchNews" or "displayNews" functions. But as far as=20
news.inc includes administrators functions, everybody can access the=20
administrator function...

=2EoO Exploit Oo.
Ok, that's really easy. You just have to send a specific URL to access th=
e=20
admin functions.

Function / URL :
Create a news / Not an URL : only posted datas. Not impossible to exploit=

Replace a news / Not an URL : only posted datas. Not impossible to exploi=
t
Delete all news / http://www.victim.com/ptnews/ index.php?delete=3Dall
Edit a news / Too difficult to exploit

=2EoO Solution Oo.
The solution is to separate the standard news functions and the administr=
ator=20
news fonctions.
Standard news functions must go to news.inc
Administrator news fonctions must go to admin.inc

The vendor has been informed and solved the problem. Download ptnews 1.7.=
8 at:
http://www.openbg.net/ptsite/


=2EoO Discovered by Oo.
Arnaud Jacques aka scrap
webmaster@securiteinfo.com
http://www.securiteinfo.com