Full Disclosure mailing list archives
Re: XSS in Postnuke Rogue release (0.72)
From: "Rick Updegrove" <dislists () updegrove net>
Date: Mon, 11 Nov 2002 23:17:55 -0800
----- Original Message ----- From: "Muhammad Faisal Rauf Danka" <mfrd () attitudex com> To: <bugtraq () securityfocus com>; <full-disclosure () lists netsys com>; <vulnwatch () vulnwatch org> Sent: Thursday, November 07, 2002 10:49 PM Subject: XSS in Postnuke Rogue release (0.72)
On postnuke’s own website this issue is handled very effectively by bouncing the user back to the > “./index.php” without giving any errors, thus reducing the chances of webroot disclosure too. I hope such functionality be added to the downloadable version of postnuke’s latest build too for the benefit of the users.
http://developers.postnuke.com/modules.php?op=modload&name=Downloads&file=in dex&req=viewdownload&cid=1 This patch also emails the site admin with an impressive "possible hack attempt" notice. I installed the 2 files and my site is no longer vulnerable. Rick Up _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- XSS in Postnuke Rogue release (0.72) Muhammad Faisal Rauf Danka (Nov 07)
- Re: XSS in Postnuke Rogue release (0.72) Rick Updegrove (Nov 12)