Nuke Patched - May 3, 2004 Update

chatserv · Posted: Mon May 03, 2004 8:40 am

XSS and full path disclosure in PhpNuke Reported by waraxe.

Open all files (except .htaccess and index.html) contained in admin/links and add the following right after the file credits:

Code:

if (!eregi("admin.php", $_SERVER['PHP_SELF'])) { die ("Access Denied"); }

Open modules/Statistics/index.php and find:

Code:

$pagetitle = "- "._STATS."";

Right below that line add:

Code:

if (isset($year)) {
$year = intval($year);
}

The patches have yet to be updated so apply these manually, i will update them ASAP, my thanks to Sting for the heads up.

Raven · Posted: Mon May 03, 2004 9:05 am

Thanks Sting and Chatserv!

chatserv · Posted: Mon May 03, 2004 9:07 am

Thanks Raven.

Users of the 6.0 patch may need to alter the admin/links line posted above if their php version is old, the line in this case would be:

Code:

if (!eregi("admin.php", $PHP_SELF)) { die ("Access Denied"); }

GanjaUK · Posted: Mon May 03, 2004 9:59 am

I can sleep easy at night because of your patches chatserv. Shocked

ballymuntrev · Hangin' Around Joined: Mar 22, 2004 Posts: 49

Yeah thanks m8, I just patched all mine now too Smile

Muffin · Client Joined: Apr 10, 2004 Posts: 649 Location: UK

Are these added to the latest patched files download Chat? Or do we have to add them ourselves?

Thanks for keeping us safe

chatserv · Posted: Sun Aug 01, 2004 7:28 pm

Yes they were added.

Muffin · Client Joined: Apr 10, 2004 Posts: 649 Location: UK

thank you Chat