Newsworld admin_news.php could allow authentication bypass

newsworld-adminnews-bypass-authentication (22860) The risk level is classified as MediumMedium Risk

Description:

Archilles Newsworld could allow a local attacker to bypass user authentication and obtain elevated privileges. A local attacker can access the session.nwd text file to copy a live session ID and send the session information to a parameter in the admin_news.php script to gain administrative access.


Consequences:

Bypass Security

Remedy:

No remedy available as of May 1, 2013.

References:

  • Archilles Scriptworld Web site: Newsworld Information. (This site is in German.)
  • Neohapsis Archives Bugtraq #0273: aRCHILLES Newsworld < 1.5.0-rc1 Multiple Vulnerabilities.
  • CVE-2005-3434: Archilles Newsworld before 1.5.0-rc1 stores (1) account.nwd and (2) session.nwd under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames, hashed passwords, and session IDs, and gain privileges.
  • CVE-2005-3435: admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtaining the password hash for another user, for example through another Newsworld vulnerability, and specifying the hash in the pwd argument.
  • OSVDB ID: 20298: archilles Newsworld admin_news.php Hashed Password Authentication Bypass
  • OSVDB ID: 20299: archilles Newsworld admin_news.php Session ID Authentication Bypass
  • SA17310: archilles Newsworld "data" Exposure of Sensitive Information

Platforms Affected:

  • Archilles Newsworld 1.3.1 to 1.5.0-rc1

Reported:

Oct 21, 2005

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page