Some vulnerabilities have been discovered in phpunity.newsmanager, which can be exploited by malicious people to disclose potentially sensitive information and conduct cross-site scripting attacks.

1) Input passed to the "id" parameter in misc/tell_a_friend/tell.php is not properly verified before being used to read files. This can be exploited to partially disclose content of arbitrary files via directory traversal attacks and URL-encoded NULL bytes.

2) Input passed to the "author", "email", "link", and "link_name" parameters in admin/news_edit.php (when "write_news" is set to "1") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Solution
Edit the source code to ensure that input is properly verified and sanitised.

Provided and/or discovered by
1) kaMtiEz
2) Mohammed Boumediane, Vupen

Changelog
Further details available to Secunia VIM customers

Original Advisory
2) http://www.vupen.com/english/advisories/2010/0977

Deep Links
Links available to Secunia VIM customers