bugtraq - Re: Possible bug in PHPNuke and other CMS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1531623766.20040601085047@cs.msu.su>
Date: Tue, 1 Jun 2004 08:50:47 +0400
From: Alexander GQ Gerasiov <bugtaq@...pp.ru>
To: Luca Falavigna <fala83@...ero.it>,
	Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Possible bug in PHPNuke and other CMS

Hello Luca,

Sunday, May 30, 2004 you wrote:

LF> -----BEGIN PGP SIGNED MESSAGE-----
LF> Hash: SHA1

LF> There is a vulnerability in PHPNuke that permits execution of arbitrary
LF> SQL queries on a database located in the same server of an attacker's
LF> account. This is the procedure: first of all attacker must create a
LF> symlink pointing to victim's db directory in PHPNuke home directory
LF> because of mainfile.php include method. After that he can build a simple
LF> php code executing a query to the PHPNuke database. Here is an example:

I'm sure that such problems must be fixed not with some hacks like
yours (checking domain name), but with webserver configuration (uid
and permissions, php abilities (like safe mode or open_base_dir
option) etc.)

-- 
Best regards,
 Alexander GQ Gerasiov <bugtaq@...pp.ru>