109 matches found
[EXPL] PHP-Nuke POST Method Admin Variable Privilege Escalation
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
PHP-Nuke v7.4 admin exploit (old exploit)
Exploit for unknown platform in category web applications ========================================= PHP-Nuke v7.4 admin exploit old exploit ========================================= / old exploit but what pretty code /str0ke / / phpNUKE v7.4 exploit this exploit create new admin with relative...
CVE-2004-0265
Cross-site scripting XSS vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded 1 title or 2 fname parameters in the News or Reviews modules...
PHP-Nuke SQL Injection Edit/Save Message(s) Bug
Exploit for unknown platform in category web applications =============================================== PHP-Nuke SQL Injection Edit/Save Messages Bug =============================================== !/usr/bin/perl use LWP; $log = "poskomenphpnukesavemsg.txt"; $Agent = "Mbahmubangga/1.0"; $proxy ...
PHP-Nuke - SQL Injection EditSave Messages
PHP-Nuke - SQL Injection EditSave Messages !/usr/bin/perl use LWP; $log = "poskomenphpnukesavemsg.txt"; $Agent = "Mbahmubangga/1.0"; $proxy = "http://172.9.1.11:80/"; proxy:port ... $browser = LWP::UserAgent-new; $browser - agent$Agent; $url = 'http://www.sitewithphpnuke.com/admin.php';...
phpSQLnuke.pl
XSS/SQL Injection PHP-Nuke Delete Messages Bug by bima Php-Nuke is a popular freeware content management system. Based on information at : http://www.mantralab.org/modules.php/modulo/news/lanotizia/%5BXSS%5D+PHP-Nuke+7.4+Add+Message+Bug An attacker permitted to post to global home-page messages. ...
[XSS]/SQL Injection PHP-Nuke Delete Message(s) Bug
XSS/SQL Injection PHP-Nuke Delete Messages Bug by bima Php-Nuke is a popular freeware content management system. Based on information at : http://www.mantralab.org/modules.php/modulo/news/lanotizia/5BXSS5D+PHP-Nuke+7.4+Add+Message+Bug An attacker permitted to post to global home-page messages. I...
PHP-Nuke 7.4 Remote Privilege Escalation
Exploit for unknown platform in category web applications ======================================== PHP-Nuke 7.4 Remote Privilege Escalation ======================================== A demonstration exploit HTTP form is provided: USERNAME: NOME: PASSWORD: E-MAIL: 0day.today 2018-01-05...
PHP-Nuke 0-7 - Delete God Admin Access Control Bypass
PHP-Nuke 0-7 - Delete God Admin Access Control Bypass source: https://www.securityfocus.com/bid/10861/info PHP-Nuke is reported prone to an access control bypass vulnerability. Reports indicate that a PHP-Nuke superuser may bypass access controls and privilege restrictions, to delete the PHP-Nuke...
PHP-Nuke 0-7 - Delete God Admin Access Control Bypass
source: https://www.securityfocus.com/bid/10861/info PHP-Nuke is reported prone to an access control bypass vulnerability. Reports indicate that a PHP-Nuke superuser may bypass access controls and privilege restrictions, to delete the PHP-Nuke "God Admin" account. This may be accomplished by maki...
CVE-2004-0731
Cross-site scripting XSS vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to inject arbitrary script as other users via the input field...
CVE-2004-0736
The search module in Php-Nuke allows remote attackers to gain sensitive information via the 1 "" or 2 "+" search patterns, which reveals the path in an error message...
CVE-2004-2044
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi PHP function with $SERVER'PHPSELF' to identify the calling script, which allows remote attackers to directly access scripts,...
PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
source: https://www.securityfocus.com/bid/10447/info PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed. This issue will allow an attacker to gain access to sensitive scripts...
PHP-Nuke 6.x/7.x - 'Modpath' File Inclusion
source: https://www.securityfocus.com/bid/10365/info PHP-Nuke is prone to a potential file include vulnerability. This issue could allow a remote attacker to include malicious files containing aribtrary code to be executed on a vulnerable system. This issue can be exploited via the 'modpath'...
PHP-Nuke 6.x7.x - CookieDecode Cross-Site Scripting
PHP-Nuke 6.x7.x - CookieDecode Cross-Site Scripting source: https://www.securityfocus.com/bid/10128/info Reportedly PHP-NuKe is prone to a remote cross-site scripting vulnerability. This issue is due to a failure of the 'cookiedecode' function to properly sanitize user supplied cookie parameters...
[waraxe-2004-SA#016 - Cross-Site Scripting aka XSS in phpnuke 6.x-7.2 part 3]
================================================================================ waraxe-2004-SA016 ================================================================================ Cross-Site Scripting aka XSS in phpnuke 6.x-7.2 part 3...
PHP-Nuke 6.x/7.x - CookieDecode Cross-Site Scripting
source: https://www.securityfocus.com/bid/10128/info Reportedly PHP-NuKe is prone to a remote cross-site scripting vulnerability. This issue is due to a failure of the 'cookiedecode' function to properly sanitize user supplied cookie parameters. These issues could permit a remote attacker to crea...
CVE-2004-1932
SQL injection vulnerability in 1 auth.php and 2 admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter...