NukeXchange Network

          

NukeZone Hosting - Fast, Affordable and Dependable
Nuke Fixes · NukeForums · NukeZone Hosting · NukeUnited · Nuke Sites · Nuke Skins · NukeLance
Nuke Resources
 :: Home  :: Downloads  :: Your Account  :: Forums  :: Advertise :: 
Login or Register
Main Menu
General
 Main
 AvantGo
 Banner_Clients
 cfaq
 Donations
 Downloads
 Forums
 Members_List
 Private_Messages
 Search
 Stories_Archive
 Submit_News
 Surveys
 Topics
 Web_Links
 Your_Account
Your Account
 Login
 Register
 Lost Pass
Modules
Quick Links
· CMS Focus
 · Domain Names
 . Game Quest
 · Learning Linux
 . MateMaker
 · NukeFixes
 · NukeForums
 · NukeLance
 · Nuke Sites
 · Nuke Skins
 · NukeZone Hosting
. SearchDevil
Other Options

Download Resources
· Nuke Downloads
· Add a Link
· New Files
· Top Rated
· Most Popular

Web Site Resources
· Nuke Sites
· Add A Site
· New Sites
· Top Rated
· Most Popular

Support
· NukeZone Hosting
· NukeSkins.com
· NukeForums.com
· phpnuke.org
· NukeFixes.com
Information
NukeForums
·After install 8.1 - Notice: Undefined index in mainfile.php
·character set of html filter problem after upgrade
·record user actions
·can't see comments
·General question(s) about my config (sorry, kinda long)
·Anyone else using the Php Nuke video module???
·Message Block
·Problems transfering phpbb(xavier) to nuke
·Images not showing up in NukeWeather - anyone else using it?
·v8.0 - Posted Rewiews Displaying Gobbly Gook!

read more...
Top10 Links
· 1: Nuke Forums
· 2: PHPNukeFiles
· 3: NukeSkins
· 4: Nuke Templates
· 5: EcomJunk
· 6: MDesign
· 7: Windows Installation: PHP
· 8: FLASH-FOR-NUKE
· 9: Dezina
· 10: Global Dream News Sharing Portal!
Site Visitors
User Login:

Nickname:
Password:
Security Code: Security Code
Type Security Code Here:

Members List Membership:
Latest: phweb
Today: 1
Yesterday: 5
Overall: 14694
Visitation:
Guests: 1118
Members: 1
Total: 1119

You are Anonymous user. You can register for free by clicking here
Sponsor Links
php-Nuke Themes and Templates
php-Nuke Themes and Templates

Security Advisory: phpNuke and PostNuke file access vulnerability
There is a serious security issue with phpNuke and PostNuke that was reported today on a number of sites today.

All the versions of phpNuke and possibly some versions of PostNuke and others ARE vulnerable with the exception of "phpNuke 5.0 RC1" was reported on some sites.

Thanks for the heads up to LucisFero and supergate!

Their Solution:

File:
-------------------------------------------
/admin.php
-------------------------------------------

Find:
-------------------------------------------
if ((isset($file)) AND ($file != "none")) {
$updir = "images/articles";
@copy($file, "$updir/$file_name");
}

$basedir = dirname($SCRIPT_FILENAME);
$textrows = 20;
$textcols = 85;
$udir = dirname($PHP_SELF);
if(!$wdir) $wdir="/";
if($cancel) $op="FileManager";
if($upload) {
copy($userfile,$basedir.$wdir.$userfile_name);
$lastaction = ""._UPLOADED." $userfile_name --> $wdir";
$wdir2="/";
chdir($basedir . $wdir2);
Header("Location: admin.php?op=FileManager");
exit;
}
-------------------------------------------

Erase the function and use a FTP Client to upload your files.

Alternative "quickfix" is to change:
"if($upload) {" to
"if (($upload) && ($admintest)) {"

A downloadable fix for phpNuke has been posted at http://www.phpnuke.org/article.php?sid=2662&mode=nocomments&order=0&thold=0

To read more about this please check out the links. The more you read about it the better off you will be.

http://www.twlc.net/article.php?sid=421
http://www.twlc.net/article.php?sid=423
http://sourceforge.net/tracker/?group_id=7511
http://www.nukeforums.com/forums/viewtopic.php?topic=2056&forum=29 		Security Advisory
Posted on Tuesday, September 25, 2001 @ 3:21 PM CDT by NukeResources

Multi-Site Search
Google
Web NukeResources.com
NukeFixes.com NukeSecurity.com
 

Sponsor Links
 

 
Related Links
· More about Security Advisory
· News by NukeResources
Most read story about Security Advisory:
phpNuke and PostNuke file access vulnerability
Article Rating
Average Score: 0
Votes: 0

Please take a second and vote for this article:

Excellent
Very Good
Good
Regular
Bad
Options

 Printer Friendly Page Printer Friendly Page

Re: phpNuke and PostNuke file access vulnerability (Score: 1)
by draxofavalon on Tuesday, August 03, 2004 @ 7:51 AM CDT
(User Info | Send a Message)
is this bug patched on the new phpnuke 7.4 ???
Need to find your IP fast?


Best viewed with a Browser
All logos and trademarks in this site are property of their respective owner.
The comments are property of their posters, all the rest © 2001 - 2007 by NukeResources.com
You can syndicate our news using the file .backend.php or ultramode.txt
PHP-Nuke Copyright © 2004 by Francisco Burzi. This is free software, and you may redistribute it under the GPL. PHP-Nuke comes with absolutely no warranty, for details, see the license.
Page Generation: 0.28 Seconds

:: Eos phpbb2 style by Cyberalien :: PHP-Nuke theme by www.nukemods.com ::