search menu icon-carat-right cmu-wordmark

CERT Coordination Center


NewsDaemon does not adequately filter user input to $user_username

Vulnerability Note VU#987632

Original Release Date: 2001-05-05 | Last Revised: 2001-06-25

Overview

NewsDaemon prior to version 0.21b contains a vulnerability allowing remote attackers to gain administrative access to the web site.

Description

NewsDaemon is a PHP-based tool used to allow readers to submit and comments on news items and stories over the web. It also allows for administration of the web site using HTTP. Versions of NewsDaemon prior to 0.21b allows readers of the web site to submit a malicious HTTP request allowing them to gain administrative access to the web site.

Impact

Remote intruders can gain administrative access to the web site.

Solution

Update to NewsDaemon version 0.21b or later. If you use PHP3, or cannot set register_globals offin PHP4, you must change NewsDaemon (including 0.21b) as described in the original description of this problem by Forrest J. Cavalier III.

Vendor Information

987632
Expand all

DaemonNews

Updated:  May 05, 2001

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

See http://sourceforge.net/forum/forum.php?forum_id=60570 for more information.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Our thanks to Forrest J. Cavalier III who originally posted this information to BugTraq.

This document was written by Shawn V. Hernan

Other Information

CVE IDs: CVE-2001-0234
Severity Metric: 3.19
Date Public: 2001-01-26
Date First Published: 2001-05-05
Date Last Updated: 2001-06-25 21:14 UTC
Document Revision: 10

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.