=2EoO Overview Oo.

Cutenews 1.3 information disclosure
Discovered on 2003, July, 12th
Vendor: CutePHP

Cutenews is a powerful and easy for using news management system that use f=
lat=20
files to store its database. It supports comments and archives, search=20
function, image uploading, backup function, IP banning, flood protection ...
Mainely, the first job a hacker does, is to retreive a maximum of informati=
on=20
from the target server. Cutenews can help much in this task.
=46or more information, I suggest you to read "phpinfo() et la s=E9curit=E9=
" by=20
frog-m@n (french document) at=20
http://www.phpsecure.info/v2/article...o-Security.php

=2EoO Details Oo.

In the file index.php, a condition can be made to execute the PHP function=
=20
phpinfo(); Here is the interesting lines :

if($HTTP_SERVER_VARS['QUERY_STRING'] =3D=3D "debug"){ debug(); }
=2E..
function debug(){
global $config_version_name, $config_version_id, $config_http_script_dir;
echo"<center><b>CuteNews Debug Information:</b><hr><br>";
echo"Script Version/ID: $config_version_name / $config_version_id<br>";
echo"\$config_http_script_dir: $config_http_script_dir<br><BR>";
echo"<hr>";
phpinfo();

exit();
}

=2EoO Exploit Oo.

The exploit is really easy : Give the debug argument to the index.php :

http://victim.com/cutenews/index.php?debug

You will get the classical phpinfo page.

=2EoO Solution Oo.

We suggest to delete the following line from your index.php file :

if($HTTP_SERVER_VARS['QUERY_STRING'] =3D=3D "debug"){ debug(); }

The vendor has been informed.

=2EoO Discovered by Oo.

Arnaud Jacques aka scrap
webmaster@securiteinfo.com
http://www.securiteinfo.com