[35090] in bugtraq
Re: Possible bug in PHPNuke and other CMS
daemon@ATHENA.MIT.EDU (Alexander GQ Gerasiov)
Tue Jun 1 16:56:04 2004
Date: Tue, 1 Jun 2004 08:50:47 +0400
From: Alexander GQ Gerasiov <bugtaq@gq.pp.ru>
Message-ID: <1531623766.20040601085047@cs.msu.su>
To: Luca Falavigna <fala83@libero.it>, Bugtraq <bugtraq@securityfocus.com>
In-Reply-To: <40B9F55E.9050402@libero.it>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hello Luca,
Sunday, May 30, 2004 you wrote:
LF> -----BEGIN PGP SIGNED MESSAGE-----
LF> Hash: SHA1
LF> There is a vulnerability in PHPNuke that permits execution of arbitrary
LF> SQL queries on a database located in the same server of an attacker's
LF> account. This is the procedure: first of all attacker must create a
LF> symlink pointing to victim's db directory in PHPNuke home directory
LF> because of mainfile.php include method. After that he can build a simple
LF> php code executing a query to the PHPNuke database. Here is an example:
I'm sure that such problems must be fixed not with some hacks like
yours (checking domain name), but with webserver configuration (uid
and permissions, php abilities (like safe mode or open_base_dir
option) etc.)
--
Best regards,
Alexander GQ Gerasiov <bugtaq@gq.pp.ru>
