Multiple Full Disclosure Path in postnuke 0.750 phoenix

2004-09-27T00:00:00
ID SECURITYVULNS:DOC:6852
Type securityvulns
Reporter Securityvulns
Modified 2004-09-27T00:00:00

Description

[CODEBUG Labs]

Advisory #6

Title: Multiple Full Disclosure Path in postnuke 0.750 phoenix

Author: FAiN182 - fain182@infinito.it

Product: Postnuke 0.750 Phoenix

Type: Full disclosure path

Web: http://www.mantralab.org

Personal Site: http://fain182.altervista.org

---[ the product

Postnuke is a CMS (Contenent Management System) that is an improved version of php-nuke. You can find it here: http://www.phpnuke.com.

---[ the bug

The pages of the full disclosure path vulnerabilities that are in the core and in the modules of postnuke are wrote to be included in other pages, but if you access directly they made a page error mainly for Unkwon function.

---[ the exploit:

In the core of postnuke you can get an error page visiting this url:

http://www.site_with_postnuke.com/footer.php

In the other modules that are by default in postnuke:

http://www.site_with_postnuke.com/modules/Downloads/admin.php http://www.site_with_postnuke.com/modules/FAQ/admin.php http://www.site_with_postnuke.com/modules/Reviews/admin.php http://www.site_with_postnuke.com/modules/Sections/admin.php http://www.site_with_postnuke.com/modules/Submit_News/admin.php http://www.site_with_postnuke.com/modules/Top_List/admin.php http://www.site_with_postnuke.com/modules/Web_Links/admin.php

---[ the patch

You can protect the page form the direct access as is in the file header.php, writing this lines at the begin of all the page bugged in that way:

if (strpos('header.php', $_SERVER['PHP_SELF'])) { die ("You can't access this file directly..."); }

---[ Greetings

To mantra, anat3ma and all codebug project crew

---[ EOF ]-----------------------------------------------------------