PHP-Nuke 7.4 Multiple XSS Vulnerabilities Patch

From: Pierquinto Manco (mantra_at_ntj.it)
Date: 09/05/04

  • Next message: Michal Blaszczak: "Bug XSS in PsNews 1.1" 
    Date: 5 Sep 2004 11:00:06 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    ***************************************************************
                             CODEBUG LABS
    PATCH #1 to [XSS] Vulnerabilities in Admin Panel of PHP-NUKE 7.4
    ***************************************************************
    To Patch your admin panel from this vulnerabilities hurricane you have to
    apply this code to your admin.php file:
    if ( !empty($HTTP_GET_VARS['admin']) ) {
            die("***! Mantra wins =)");
    }

    if ( !empty($HTTP_POST_VARS['admin']) ) {
            die("***! Mantra wins =)");
    }

    -) Note
    Previous patch(CODEBUG #1,#2,#3) isn't enough performant.
    Try this one.
    There are a lot of this problem in PHP-Nuke 7.4, my patch will check
    the content of $_POST[admin] and $_GET[admin].
    I'm going to post all this vulnerabilities on my site...
    http://www.mantralab.org

    **************************************************************
                    http://www.mantralab.org
    **************************************************************

  • Next message: Michal Blaszczak: "Bug XSS in PsNews 1.1"