PHP-Nuke 5.5 and 6.0: Path Disclosure

Product - PHP-Nuke + Version - 5.5, 6.0 other versions not tested jet + Website - http://www.phpnuke.org + Problems - Path Disclosure + Explanation: The fault happens in the file print.php, which this including in the modulos 'News' and 'AvantGo', in the same one is checked that the variable $sid...

PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure

PHP-Nuke Splatt Forum 3.2 Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7080/info The Splatt Forum module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker could use the...

PHP-Nuke 5.56.0 News Module - Full Path Disclosure

PHP-Nuke 5.56.0 News Module - Full Path Disclosure source: https://www.securityfocus.com/bid/7079/info The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker. An attacker may use the information...

PHP-Nuke 6.0 & 6.5RC2 SQL Injection Again

Informations : °°°°°°°°°°°°°° Language : PHP Website : http://www.phpnuke.org Version : 6.0 & 6.5 RC2 Modules : Forums, PrivateMessages Problem : SQL Injection PHP Code/Location : °°°°°°°°°°°°°°°°°°° /modules/Forums/viewtopic.php :...

phpnuke60.2.txt

Informations : °°°°°°°°°°°°°° Language : PHP Website : http://www.phpnuke.org Version : 6.0 & 6.5 RC2 Modules : Forums, PrivateMessages Problem : SQL Injection PHP Code/Location : °°°°°°°°°°°°°°°°°°° /modules/Forums/viewtopic.php :...

[UNIX] Sourceforge Jacobuddy Cross Site Scripting (XSS) and Upload Exploit

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion In the US? Contact Beyond Security at our new California office housewarming rates on automated network vulnerability scanning. We also...

PHP-Nuke 6.0 (& 6.5?) : Serious SQL Injection Security Holes

Informations : °°°°°°°°°°°°°° Language : PHP Website : http://www.phpnuke.org Versions : 6.0 & 6.5? Modules : MembersList, YourAccount Problem : SQL Injection PHP Configuration : This will work if magicquotesgpc=OFF. PHP Code/Location : °°°°°°°°°°°°°°°°°°° /modules/MembersList/index.php :...

PHP-Nuke Detection

The remote host is running a copy of PHP-Nuke. Given the insecurity history of this package, the Nessus team recommends that you do not use it but use something else instead, as security was clearly not in the mind of the persons who wrote it. The author of PHP-Nuke Francisco Burzi even started t...

PHP-Nuke 5.x/6.0 - Avatar HTML Injection

source: https://www.securityfocus.com/bid/6750/info A problem with PHP-Nuke could allow remote users to execute arbitrary code in the context of the web site. The problem is in the lack of sanitization of some types of input. PHP-Nuke does not sanitize code submitted to a site from the avatar...

PHP-Nuke 5.x6.0 - Avatar HTML Injection

PHP-Nuke 5.x6.0 - Avatar HTML Injection source: https://www.securityfocus.com/bid/6750/info A problem with PHP-Nuke could allow remote users to execute arbitrary code in the context of the web site. The problem is in the lack of sanitization of some types of input. PHP-Nuke does not sanitize code...

php-nuke again ...

-----BEGIN PGP SIGNED MESSAGE----- I. BACKGROUND PHP-Nuke is a popular Web portal system. Project homepage : http://www.phpnuke.org II. DESCRIPTION Remote attacker could transfer to server his own file or copy arbitrary file from system to accessible directory. The result of such acts could be...

CVE-2002-1995

Cross-site scripting XSS vulnerability in phptonuke.php for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the filnavn parameter...

CVE-2002-2032

sqllayer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sqldebug parameter to 1 index.php and 2 modules.php...

CVE-2002-1803

Cross-site scripting XSS vulnerability in PHP-Nuke 6.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag...

PT-2002-2753 · Php · Php-Nuke

Name of the Vulnerable Software and Affected Versions: PHP-Nuke versions 5.4 and earlier Description: The issue allows remote attackers to gain SQL query information by exploiting debugging features that are not properly restricted. This can be achieved by setting the sql debug parameter in...

PHP-Nuke 6.0 - modules.php Denial of Service

PHP-Nuke 6.0 - modules.php Denial of Service source: https://www.securityfocus.com/bid/6465/info A denial of service vulnerability has been reported for the modules.php script used by PHP-Nuke. The vulnerability occurs because the modules.php script does not properly validate some URI parameters...

PHP-Nuke 6.0 - 'modules.php' Denial of Service

source: https://www.securityfocus.com/bid/6465/info A denial of service vulnerability has been reported for the modules.php script used by PHP-Nuke. The vulnerability occurs because the modules.php script does not properly validate some URI parameters. An attacker can exploit this vulnerability b...

PHP-Nuke 6.0 : Path Disclosure & Cross Site Scripting

Informations : °°°°°°°°°°°°°° Product : PHP-Nuke Version : 6.0 Website : http://www.phpnuke.org Problems : - Path Disclosure - XSS Developpement : °°°°°°°°°°°°°°° The majority of the PHPNuke's files are includes in modules.php or index.php. To prevent the direct access, PHPNuke made two kinds of...

PHP-Nuke code execution and XSS vulnerabilities

PHP-Nuke code execution and XSS vulnerabilities PROGRAM: PHP-Nuke VENDOR: Fransisco Burzi et al. HOMEPAGE: http://phpnuke.org/ VULNERABLE VERSIONS: 6.0 the only supported version IMMUNE VERSIONS: 6.0 with my patch applied LOGIN REQUIRED: no DESCRIPTION: "PHP-Nuke is a Web portal and online...

PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities

PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/6409/info It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for...