Php-nuke Input Validation Hole

Full Version: Php-nuke Input Validation Hole

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Jun 8 2004, 07:17 PM

QUOTE

PHP-Nuke Input Validation Hole in Reviews Module 'id' and 'title' Parameter Permits Cross-Site Scripting Attacks

PROGRAM: PHP-Nuke
HOMEPAGE: http://phpnuke.org/
VERSION: 6.x, 7.2, 7.3
BUG: Multiple vulnerabilities
DATE: 14/05/2004
AUTHOR: DarkBicho
web: http://www.darkbicho.tk
team: Security Wari Proyects <www.swp-zone.org>
Email: darkbicho@peru.com

-------------------------------------------------------------------------------------------------

1.- Affected software description:
-----------------------------

Php-Nuke is a popular content management system, written in php by
Francisco Burzi.

2.- Vulnerabilities:
---------------

A. Full path disclosure:

This vulnerability would allow a remote user to determine the full
path to the web root directory and other potentially sensitive
information.

:.: Examples:

http://localhost/nuke1/modules.php?name=Re...='DarkBicho

Warning: date(): Windows does not support dates prior to midnight
(00:00:00),
January 1, 1970 in c:\appserv\www\nuke1\modules\Reviews\index.php on
line 527

B. Cross-Site Scripting aka XSS:

:.: id :

*
http://localhost/nuke1/modules.php?name=Re...d='&title=a

<input type=hidden name=id value='>

:.: title :

*
http://localhost/nuke1/modules.php?name=Re...d='&title=a

:.: Examples:

http://localhost/nuke1/modules.php?name=Re...</h1&title=a

http://localhost/nuke1/modules.php?name=Re...icho</h1>

3.- SOLUTION:
¨¨¨¨¨¨¨¨
Vendors were contacted many weeks ago and plan to release a fixed
version soon.
Check the PHP-NUKE website for updates and official release details.

4.- Greetings:
---------

greetings to my Peruvian group swp and perunderforce

"EL PISCO ES Y SERA PERUANO"

5.- Contact
-------

WEB: http://www.darkbicho.tk
EMAIL: darkbicho@peru.com

Source: http://www.securitytracker.com/alerts/2004/Jun/1010420.html

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.