Bugtraq mailing list archives
Re: Possible bug in PHPNuke and other CMS
From: Alexander GQ Gerasiov <bugtaq () gq pp ru>
Date: Tue, 1 Jun 2004 08:50:47 +0400
Hello Luca, Sunday, May 30, 2004 you wrote: LF> -----BEGIN PGP SIGNED MESSAGE----- LF> Hash: SHA1 LF> There is a vulnerability in PHPNuke that permits execution of arbitrary LF> SQL queries on a database located in the same server of an attacker's LF> account. This is the procedure: first of all attacker must create a LF> symlink pointing to victim's db directory in PHPNuke home directory LF> because of mainfile.php include method. After that he can build a simple LF> php code executing a query to the PHPNuke database. Here is an example: I'm sure that such problems must be fixed not with some hacks like yours (checking domain name), but with webserver configuration (uid and permissions, php abilities (like safe mode or open_base_dir option) etc.) -- Best regards, Alexander GQ Gerasiov <bugtaq () gq pp ru>
Current thread:
- Re: Possible bug in PHPNuke and other CMS Peter Hagstrøm (Jun 01)
- <Possible follow-ups>
- Re: Possible bug in PHPNuke and other CMS Alexander GQ Gerasiov (Jun 01)
- Re: Possible bug in PHPNuke and other CMS Luca Falavigna (Jun 01)
- Re: Possible bug in PHPNuke and other CMS BlueRaven (Jun 04)
- Re: Possible bug in PHPNuke and other CMS Luca Falavigna (Jun 01)