bugtraq - PostNuke Sensitive Information Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030326234703.81670.qmail@uncompiled.com>
Date: Wed, 26 Mar 2003 18:47:03 -0500
From: "rkc" <rkc@...ompiled.com>
To: bugtraq@...urityfocus.com
Subject: PostNuke Sensitive Information Disclosure


Title: PostNuke path disclosure, and... (db name).
Version: 0.7.2.3-Phoenix (other)
Problem: 

A vulnerability have been found in Postnuke (v0.7.2.3-Phoenix) which allow 
users to determine the physical path of this cms. 

This vulnerability would allow a remote user to determine the full path to 
the web root directory and other information, like the database name (!) 


Example: 

http://www.target.com/modules.php?op=modload&name=Members_List&file=index&le 
tter=All&sortby=uname1234 

Change 1234 by anything. 


 ----- 

If you are looking for: 

* Path disclosure in 0.7.2.2 & 0.7.2.1 v:
(Two simples examples) 

http://www.target.com/modules.php?op=modload&name=Stats&file= 

http://www.target.com/modules.php?op=modload&name=Members_List&file=index&le 
tter=Svi&sortby=uname1234 

(Change 1234 by anything). 

(not.always) 

 ----- 

Solutions: 

Change the Member_List privileges, for admin's only (?)
Deactivate the Member_List module (?) 

 ----- 


Greetz ! 


rkc 

~
Rep. Argentina
6765656B207374796C65
StFU, and RtFM !