bugtraq - Re: Re: Mambo Open Source, Path disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 6 Nov 2005 14:32:05 -0000
From: trueend5@...oo.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: Mambo Open Source, Path disclosure


You are right 
mamboserver soloution is available now:
The fix is easy,

in /component/com_content/content.php
Approx Line 190 Change the block FROM:


Code:
// Paramters
	$params = new stdClass();
	if ( $Itemid ) {
		$menu = new mosMenu( $database );
		$menu->load( $Itemid );
		$params =& new mosParameters( $menu->params );
	} else {
		$menu = "";
		$params =& new mosEmpty();

	}

CHANGE TO READ:

Code:
// Paramters
	$params = new stdClass();
	if ( $Itemid ) {
		$menu = new mosMenu( $database );
		$menu->load( $Itemid );
		$params =& new mosParameters( $menu->params );
	} else {
		$menu = "";
		$params =& new mosParameters(''); //mosEmpty();

	}
best regards
Alireza Hassani
Security Science Researchers Institute Of Iran
[http://www.KAPDA.ir]