[36589] in bugtraq
Multiple Full Disclosure Path in postnuke 0.750 phoenix
daemon@ATHENA.MIT.EDU (FAiN182)
Mon Sep 20 21:14:37 2004
Date: 18 Sep 2004 18:12:57 -0000
Message-ID: <20040918181257.8858.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: FAiN182 <fain182@infinito.it>
To: bugtraq@securityfocus.com
#####################################################################
# [CODEBUG Labs] #
# Advisory #6 #
# Title: Multiple Full Disclosure Path in postnuke 0.750 phoenix #
# Author: FAiN182 - fain182@infinito.it #
# Product: Postnuke 0.750 Phoenix #
# Type: Full disclosure path #
# Web: http://www.mantralab.org #
# Personal Site: http://fain182.altervista.org #
#####################################################################
---[ the product
Postnuke is a CMS (Contenent Management System) that is an improved
version of php-nuke. You can find it here: http://www.phpnuke.com.
---[ the bug
The pages of the full disclosure path vulnerabilities that are in
the core and in the modules of postnuke are wrote to be included
in other pages, but if you access directly they made a page error
mainly for Unkwon function.
---[ the exploit:
In the core of postnuke you can get an error page visiting this url:
http://www.site_with_postnuke.com/footer.php
In the other modules that are by default in postnuke:
http://www.site_with_postnuke.com/modules/Downloads/admin.php
http://www.site_with_postnuke.com/modules/FAQ/admin.php
http://www.site_with_postnuke.com/modules/Reviews/admin.php
http://www.site_with_postnuke.com/modules/Sections/admin.php
http://www.site_with_postnuke.com/modules/Submit_News/admin.php
http://www.site_with_postnuke.com/modules/Top_List/admin.php
http://www.site_with_postnuke.com/modules/Web_Links/admin.php
---[ the patch
You can protect the page form the direct access as is in the file
header.php, writing this lines at the begin of all the page bugged
in that way:
if (strpos('header.php', $_SERVER['PHP_SELF'])) {
die ("You can't access this file directly...");
}
---[ Greetings
To mantra, anat3ma and all codebug project crew
---[ EOF ]-----------------------------------------------------------
