bugtraq - Multiple Full Disclosure Path in postnuke 0.750 phoenix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 18 Sep 2004 18:12:57 -0000
From: FAiN182 <fain182@...inito.it>
To: bugtraq@...urityfocus.com
Subject: Multiple Full Disclosure Path in postnuke 0.750 phoenix




#####################################################################
#               [CODEBUG Labs]                                      #
# Advisory #6                                                       #
# Title: Multiple Full Disclosure Path in postnuke 0.750 phoenix    #
# Author: FAiN182 - fain182@...inito.it                             #
# Product: Postnuke 0.750 Phoenix                                   #
# Type: Full disclosure path                                        #
# Web: http://www.mantralab.org                                     #
# Personal Site: http://fain182.altervista.org                      #
#####################################################################

---[ the product

  Postnuke is a CMS (Contenent Management System) that is an improved
  version of php-nuke. You can find it here: http://www.phpnuke.com.

---[ the bug

  The pages of the full disclosure path vulnerabilities that are in
  the core and in the modules of postnuke are wrote to be included
  in other pages, but if you access directly they made a page error
  mainly for Unkwon function.


---[ the exploit:

  In the core of postnuke you can get an error page visiting this url:

http://www.site_with_postnuke.com/footer.php

  In the other modules that are  by default in postnuke:

http://www.site_with_postnuke.com/modules/Downloads/admin.php
http://www.site_with_postnuke.com/modules/FAQ/admin.php
http://www.site_with_postnuke.com/modules/Reviews/admin.php
http://www.site_with_postnuke.com/modules/Sections/admin.php
http://www.site_with_postnuke.com/modules/Submit_News/admin.php
http://www.site_with_postnuke.com/modules/Top_List/admin.php
http://www.site_with_postnuke.com/modules/Web_Links/admin.php

---[ the patch

  You can protect the page form the direct access as is in the file
  header.php, writing this lines at the begin of all the page bugged
  in that way:

if (strpos('header.php', $_SERVER['PHP_SELF'])) {
  die ("You can't access this file directly...");
}

---[ Greetings

  To mantra, anat3ma and all codebug project crew
  
---[ EOF ]-----------------------------------------------------------