Flatnuke Index.PHP Directory Traversal Vulnerability

Bugtraq ID:	15796
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 10 2005 12:00AM
Updated:	Dec 10 2005 12:00AM
Credit:	rgod is credited with the discovery of this vulnerability.
Vulnerable:	FlatNuke FlatNuke 2.5.6
Not Vulnerable:

Flatnuke Index.PHP Directory Traversal Vulnerability

Flatnuke is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

A remote attacker may employ directory traversal strings '../' to read sensitive files containing MD5 password hashes, and create malicious cookie data which may be used to log in as an administrative user. An attacker may then create and execute malicious code, which may be executed within the context of the administrative user's account. This code may be executed within the context of the affected Web server process.

Flatnuke 2.5.6 is affected; earlier versions may also be affected.

Flatnuke Index.PHP Directory Traversal Vulnerability

No exploit is required.

An example URI has been provided:

http://www.example.com/?mod=read&id=../forum/users/[adminname].php%00

Sample exploit code has been provided as well:

• /data/vulnerabilities/exploits/flatnuke_256_xpl.php

Flatnuke Index.PHP Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Flatnuke Index.PHP Directory Traversal Vulnerability

References:

• Dell KACE K1000 Systems Management Appliance Homepage (DELL)
  
• Flatnuke 2.5.6 privilege escalation / remote commands execution exploit (rgod)