[原文]Directory traversal vulnerability in the editnews module (inc/editnews.mdu) in index.php in CuteNews 1.4.1 allows remote attackers to read or modify files via the source parameter in the (1) editnews or (2) doeditnews action. NOTE: this can also produce resultant XSS when the target file does not exist.
CuteNews Editnews Function source Variable Traversal
CuteNews contains a flaw that allows a remote attacker to manipulate arbitrary files outside of the web path. The issue is due to the Editnews functionality not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the 'source' variable. Additionally, depending on the PHP configuration, this may be used to conduct cross site scripting attacks.