myPHPNuke Information Disclosure Vulnerability

Bugtraq ID:	6541
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2003 12:00AM
Updated:	Jan 06 2003 12:00AM
Credit:	Discovery of this vulnerability credited to "Mindwarper" <[email protected]>.
Vulnerable:	myPHPNuke myPHPNuke 1.8.8 _final_7 myPHPNuke myPHPNuke 1.8.8
Not Vulnerable:

myPHPNuke Information Disclosure Vulnerability

An information disclosure vulnerability has been reported for myPHPNuke. The vulnerability exists due to insufficient checks performed in the system_footer.php script file. The system_footer.php script calls the phpinfo() function without checking who the user is.

An attacker can exploit this vulnerability by making a request for the system_footer.php script. The system will respond by disclosing information to a remote attacker.

myPHPNuke Information Disclosure Vulnerability

There is no exploit code required.

myPHPNuke Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

myPHPNuke Information Disclosure Vulnerability

References:

• myPHPNuke Homepage (myPHPNuke)
  
• phpmynuke css and phpinfo() vuls ("Mindwarper" )