[28384] in bugtraq
phpmynuke css and phpinfo() vuls
daemon@ATHENA.MIT.EDU (Mindwarper)
Mon Jan 6 19:34:09 2003
Message-ID: <184672003105112959812@hehe.com>
From: "Mindwarper" <logger@hehe.com>
To: bugtraq@securityfocus.com
Date: Sun, 5 Jan 2003 05:29:59 -0600
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
myphpnuke version 1.8.8_final_7 and prior that contain sysinfo are
vulnerable to both css attack and phpinfo() Disclosure. The problem is that
unlike the rest of the scripts under /admin/, sysinfo's footer script
called system_footer.php does not check who the user is.
Inside system_footer.php the following code is run:
echo "<br>";
phpinfo();
echo "<br>";
Thus showing any remote user sensitive data about the server.
-
Another problem in myphpnuke is the unchecked template includes.
Examples:
http://victim/html/partner.php?mainfile=anything&Default_Theme='<script>aler
t(document.cookie);</script>
http://victim/html/chatheader.php?mainfile=anything&Default_Theme='<script>a
lert(document.cookie);</script>
...and a couple more of these exist.
- Mindwarper
-- logger@hehe.com
_____________________________________________
Free email with personality! Over 200 domains!
http://www.MyOwnEmail.com
Looking for friendships,romance and more?
http://www.MyOwnFriends.com
