bugtraq - [SECURITYREASON.COM] PostNuke XSS 0.760{RC2,RC3}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 21 May 2005 15:07:52 -0000
From: Maksymilian Arciemowicz <max@...tsuper.pl>
To: bugtraq@...urityfocus.com
Subject: [SECURITYREASON.COM] PostNuke XSS 0.760{RC2,RC3}




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[PostNuke XSS 0.760{RC2,RC3} cXIb8O3.6]

Author: Maksymilian Arciemowicz ( cXIb8O3 )
Date: 4.3.2005
from SECURITYREASON.COM

- --- 0.Description ---

PostNuke: The Phoenix Release (0.750)

PostNuke is an open source, open developement content management system
(CMS). PostNuke started as a fork from PHPNuke (http://www.phpnuke.org) and
provides many enhancements and improvements over the PHP-Nuke system. PostNuke
is still undergoing development but a large number of core functions are now
stabilising and a complete API for third-party developers is now in place.
If you would like to help develop this software, please visit our homepage
at http://noc.postnuke.com/
You can also visit us on our IRC Server irc.postnuke.com channel
#postnuke-support
#postnuke-chat
#postnuke
Or at the Community Forums located at:
http://forums.postnuke.com/

- --- 1. Cross Site Scripting in RSS module ---
1.0
http://[HOST]/[DIR]/modules/RSS/pnincludes/scripts/magpie_slashbox.php?rss_url=[XSS]

1.1
http://[HOST]/[DIR]/modules/RSS/pnincludes/scripts/magpie_simple.php?url=">[XSS]

1.2
http://[HOST]/[DIR]/modules/RSS/pnincludes/scripts/magpie_debug.php?url=%22%3E[XSS]

- --- 2. Full path disclosure in RSS module ---

2.0 
http://[HOST]/[DIR]/modules/RSS/pnincludes/scripts/simple_smarty.php

- ---

Warning: main(/home/kellan/projs/magpierss/scripts/Smarty/Smarty.class.php) [function.main]: failed to open stream: No such file or directory in /www/PostNuke-0.760-RC3/html/modules/RSS/pnincludes/scripts/simple_smarty.php on line 8

Fatal error: main() [function.require]: Failed opening required '/home/kellan/projs/magpierss/scripts/Smarty/Smarty.class.php' (include_path='.:') in /www/PostNuke-0.760-RC3/html/modules/RSS/pnincludes/scripts/simple_smarty.php on line 8

- ---

- --- 3. How to fix ---

PostNuke 0.760-RC4b 

but this version is RC.

- --- 4. Greets ---

sp3x

- --- 5.Contact ---
Author: Maksymilian Arciemowicz
Email: max [at] jestsuper [dot] pl
GPG-KEY: SECURITYREASON.COM
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (FreeBSD)

iD8DBQFCjuqZznmvyJCR4zQRAkjuAJsHqeZTmsWkJbfj+x1bOFnTjYql+wCfXaxZ
IFl3B4QhPk8c27Ypsenu8kw=
=XJz2
-----END PGP SIGNATURE-----