PHPNuke Remote File Copy Vulnerability
BID:3361
Info
PHPNuke Remote File Copy Vulnerability
| Bugtraq ID: | 3361 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2001 12:00AM |
| Updated: | Sep 24 2001 12:00AM |
| Credit: | Discovered by LucisFero and supergate. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 5.2 a Francisco Burzi PHP-Nuke 5.2 Francisco Burzi PHP-Nuke 5.1 Francisco Burzi PHP-Nuke 5.0.1 Francisco Burzi PHP-Nuke 5.0 Francisco Burzi PHP-Nuke 4.4.1 a Francisco Burzi PHP-Nuke 4.4 Francisco Burzi PHP-Nuke 4.3 Francisco Burzi PHP-Nuke 4.0 Francisco Burzi PHP-Nuke 3.0 Francisco Burzi PHP-Nuke 2.5 Francisco Burzi PHP-Nuke 1.0 |
| Not Vulnerable: | |
Discussion
PHPNuke Remote File Copy Vulnerability
PHP Nuke is a website creation/maintenance tool written in PHP3.
PHP Nuke contains a vulnerability in 'admin.php' that may allow for remote attackers to overwrite files with custom data on target webservers.
May allow for an attacker to gain access to the host, cause denial of service or deface the target website.
PostNuke, a derivative of PHP Nuke, is also vulnerable.
PHP Nuke is a website creation/maintenance tool written in PHP3.
PHP Nuke contains a vulnerability in 'admin.php' that may allow for remote attackers to overwrite files with custom data on target webservers.
May allow for an attacker to gain access to the host, cause denial of service or deface the target website.
PostNuke, a derivative of PHP Nuke, is also vulnerable.
Exploit / POC
PHPNuke Remote File Copy Vulnerability
This vulnerability can be exploited with a web browser.
This vulnerability can be exploited with a web browser.
Solution / Fix
PHPNuke Remote File Copy Vulnerability
Solution:
An unofficial fix has been suggested by Magnus Skjegstad <[email protected]>:
In "admin.php"; change
"if($upload) {" to
"if (($upload) && ($admintest)) {"
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
An unofficial fix has been suggested by Magnus Skjegstad <[email protected]>:
In "admin.php"; change
"if($upload) {" to
"if (($upload) && ($admintest)) {"
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.