PT-2009-6294 · Cutenews · Cutenews

Published 2009-11-30 · Updated 2018-10-10 · CVE-2009-4115

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CuteNews version 1.4.6

Description The issue allows remote authenticated users with administrative privileges to inject arbitrary PHP code. This can be achieved through the Categories module by injecting code into data/category.db.php via the category and Icon URL fields, or into data/ipban.php via the add ip parameter.

Recommendations For CuteNews version 1.4.6, consider disabling the Categories module until a patch is available to prevent arbitrary PHP code injection. Restrict access to the category and Icon URL fields, as well as the add ip parameter, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-4115

Affected Products

Cutenews

References · 5

• 🔥 https://exploit-db.com/exploits/1289 · Exploit
• 🔥 http://morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4115 · Security Note
• http://securityfocus.com/archive/1/507782/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54243 · Note