[29522] in bugtraq
PostNuke Sensitive Information Disclosure
daemon@ATHENA.MIT.EDU (rkc)
Thu Mar 27 20:29:42 2003
Message-ID: <20030326234703.81670.qmail@uncompiled.com>
From: "rkc" <rkc@uncompiled.com>
To: bugtraq@securityfocus.com
Date: Wed, 26 Mar 2003 18:47:03 -0500
Mime-Version: 1.0
Content-Type: text/plain; format=flowed; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Title: PostNuke path disclosure, and... (db name).
Version: 0.7.2.3-Phoenix (other)
Problem:
A vulnerability have been found in Postnuke (v0.7.2.3-Phoenix) which allow
users to determine the physical path of this cms.
This vulnerability would allow a remote user to determine the full path to
the web root directory and other information, like the database name (!)
Example:
http://www.target.com/modules.php?op=modload&name=Members_List&file=index&le
tter=All&sortby=uname1234
Change 1234 by anything.
-----
If you are looking for:
* Path disclosure in 0.7.2.2 & 0.7.2.1 v:
(Two simples examples)
http://www.target.com/modules.php?op=modload&name=Stats&file=
http://www.target.com/modules.php?op=modload&name=Members_List&file=index&le
tter=Svi&sortby=uname1234
(Change 1234 by anything).
(not.always)
-----
Solutions:
Change the Member_List privileges, for admin's only (?)
Deactivate the Member_List module (?)
-----
Greetz !
rkc
~
Rep. Argentina
6765656B207374796C65
StFU, and RtFM !
