| Description: | Summary:
CuteNews/UTF-8 CuteNews is prone to multiple vulnerabilities.
Vulnerability Insight:
- An improper validation of user-supplied input by the 'category.db.php'
script via the Category Access field or Icon URL fields
- An improper validation of user-supplied input by the 'data/ipban.php' script via the add_ip parameter.
- An improper validation of user-supplied input by the 'Editnews module' via list or editnews parameters and
'Options module' via save_con[skin] parameter.
- An error in 'editusers' module within 'index.php' allows attackers to hijack the authentication of
administrators for requests that create new users.
- An error in 'from_date_day' parameter to 'search.php' which reveals the installation path in an error message.
- An error in 'modified id' parameter in a 'doeditnews' action allows remote users with Journalist or Editor
access to bypass administrative moderation and edit previously submitted articles.
- An improper validation of user-supplied input by the result parameter to 'register.php', the user parameter to
'search.php', the cat_msg, source_msg, postponed_selected, unapproved_selected, and news_per_page parameters in a
list action to the editnews module of 'index.php' and the link tag in news comments
- An error in lastusername and mod parameters to 'index.php' and the title parameter to 'search.php' it allow
attackers to inject arbitrary web script or HTML
Vulnerability Impact:
Successful exploitation could allow remote attackers to steal user
credentials, disclose file contents, disclose the file path of the application, execute arbitrary commands.
Affected Software/OS:
CuteNews version 1.4.6 and UTF-8 CuteNews version prior to 8b.
Solution:
For UTF-8 CuteNews Upgrade to version 8b or later.
For CuteNews Upgrade to version 1.5.0.1 or later.
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
