bugtraq - Good Patch to Multiple [XSS] Vulnerabilities in PHP-Nuke 7.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040906195643.3469.qmail@www.securityfocus.com>
Date: 6 Sep 2004 19:56:43 -0000
From: Pierquinto Manco <pierquinto@...il.com>
To: bugtraq@...urityfocus.com
Subject: Good Patch to Multiple [XSS] Vulnerabilities in PHP-Nuke 7.4




**************************************************************
* 			CODEBUG Labs
* Patch #1
* Title: Multiple XSS Bug in admin.php
* Author: Pierquinto 'Mantra' Manco
* Product: PHP-Nuke 7.4
* Web: http://www.mantralab.org
* 
* Register to our site and receive our newsletter!
**************************************************************

- ) Patch

Apply this code to your admin.php file:

if ( !empty($HTTP_GET_VARS['admin']) ) {
	die("Shit! Mantra wins =)");
}

if ( !empty($HTTP_POST_VARS['admin']) ) {
	die("Shit! Mantra wins =)");
}

-) Note
Previous patch isn't enough performant.
Try this one.
There are a lot of this problem in PHP-Nuke 7.4, my patch will check
the content of $_POST[admin] and $_GET[admin].
I'm going to post all this vulnerabilities on my site...
http://www.mantralab.org

**************************************************************
		http://www.mantralab.org
**************************************************************