config.php%26userfile_name%3Dscanalert.txt


Content-Type=application%2Fx-www-form-urlencoded





Confidential - McAfee Security Audit Report Page 21


Affects: 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35


Version less than Apache httpd 2.0.40


Important: Path vulnerability ---> CVE-2002-0661


Affects: 2.0.39, 2.0.37, 2.0.36, 2.0.35


Low: Path revealing exposures ---> CVE-2002-0654


Affects: 2.0.39, 2.0.37?, 2.0.36?, 2.0.35?


Version less than Apache httpd 2.0.37


Critical: Apache Chunked encoding vulnerability ---> CVE-2002-0392


Affects: 2.0.36, 2.0.35


Version less than Apache httpd 2.0.36


Low: Warning messages could be displayed to users ---> CVE-2002-1592


Affects: 2.0.35


CVSS


7.5


Solution


Upgrade to newer version


Detail


Apache/2.0.58 ---> Verify that you are running the Latest version of Apache.


Links


httpd.apache.org


Related


None


Web Application Cross Site Scripting


Port First Detected Category


80 22/04/2009 20:50 Web Application


Protocol Fix Difficulty Impact


HTTP Medium Cross Site Scripting (XSS)


Description


The remote web application appears to be vulnerable to cross-site scripting (XSS).


The cross-site scripting attack is one of the most common, yet overlooked, security problems facing web developers today. A web


site is vulnerable if it displays user-submitted content without sanitizing user input.


The target of cross-site scripting attacks is not the server itself, but the users of the server. By finding a page that does not


properly sanitize user input the attacker submits client-side code to the server that will then be rendered by the client. It is


important to note that websites that use SSL are just as vulnerable as websites that do not encrypt browser sessions.


The damage caused by such an attack can range from stealing session and cookie data from your customers to loading a virus


payload onto their computer via browser.


The pages listed in the vulnerability output will display embedded javascript with no filtering back to the user.


CVSS


5.8


Solution


When accepting user input ensure that you are HTML encoding potentially malicious characters if you ever display the data back


Confidential - McAfee Security Audit Report Page 22


to the client.


Ensure that parameters and user input are sanitized by doing the following:


Remove < input and replace with &lt;


Remove > input and replace with &gt;


Remove ' input and replace with &apos;


Remove " input and replace with &#x22;


Remove ) input and replace with &#x29;


Remove ( input and replace with &#x28;


Detail


Protocol http Port 80Read Timeout10000Method POST


Path /modules.php


Que


ry


name=Web_Links


l_op=search


query=


Hea


ders


Referer=http%3A%2F%2Fwww.YOURDOMAIN.COM%3A80%2Fmodules.php%3Fname%3DWeb_Links%26l_op


%3Dviewlinkdetails%26lid%3D1%26ttitle%3D..%252F..%252F..%252F..%252F..%252F..%252Fetc%252F


passwd%2500_Home_Of_PHP-Nuke_Special_Edition


Content-Type=application%2Fx-www-form-urlencoded


Bodyquery=>"></title></iframe></script></form></td></tr><br><iFraMe src=http://www.HackerSafe.com


width=900 height=1100></IfRamE>


Protocol http Port 80Read Timeout10000Method POST


Path /modules.php


Query


name=Downloads


op=search


query=


Heade


rs


Referer=http%3A%2F%2Fwww.YOURDOMAIN.COM%3A80%2Fmodules.php%3Fname%3DDownloads


Content-Type=application%2Fx-www-form-urlencoded


Body query=>"></title></iframe></script></form></td></tr><br><iFraMe src=http://www.HackerSafe.com


width=900 height=1100></IfRamE>


Protocol http Port 80Read Timeout10000Method POST


Path /modules.php


Query name=Feedback


Heade


rs


Referer=http%3A%2F%2Fwww.YOURDOMAIN.COM%3A80%2Fmodules.php%3Fname%3DFeedback


Content-Type=application%2Fx-www-form-urlencoded


Body


sender_name=>"></title></iframe></script></form></td></tr><br><iFraMe


src=http://www.HackerSafe.com width=900 height=1100></IfRamE>


sender_email=0


message=0


opi=ds


submit=Verzenden


Protocol http Port 80Read Timeout10000Method POST


Path /modules.php


Query name=Feedback


Heade


rs


Referer=http%3A%2F%2Fwww.YOURDOMAIN.COM%3A80%2Fmodules.php%3Fname%3DFeedback


Content-Type=application%2Fx-www-form-urlencoded


Body


sender_name=0


sender_email=>"></title></iframe></script></form></td></tr><br><iFraMe


src=http://www.HackerSafe.com width=900 height=1100></IfRamE>


message=0


opi=ds


submit=send

<?php





/**************************************************************************/


/* PHP-NUKE: Advanced Content Management System                           */


/* ============================================                           */


/*                                                                        */


/* This is the language module with all the system messages               */


/*                                                                        */


/* If you made a translation, please go to the site and send to me        */


/* the translated file. Please keep the original text order by modules,   */


/* and just one message per line, also double check your translation!     */


/*                                                                        */


/* You need to change the second quoted phrase, not the capital one!      */


/*                                                                        */


/* If you need to use double quotes (') remember to add a backslash (\),  */


/* so your entry will look like: This is \'double quoted\' text.          */


/* And, if you use HTML code, please double check it.                     */


/**************************************************************************/





define("_PRINTER","Printervriendelijke pagina");


define("_FRIEND","Stuur dit verhaal naar een kennis");


define("_YOURNAME","Uw naam");


define("_OK","Ok!");


define("_ALLOWEDHTML","Toegestane HTML:");


define("_EXTRANS","Extrans (HTML-tags naar tekst)");


define("_HTMLFORMATED","HTML Geformatteerd");


define("_PLAINTEXT","Alleen tekst");


define("_ARTICLES","Artikelen");


define("_SUBMITNEWS","Nieuws inzenden");


define("_SUBMITADVICE","Vul het volgende formulier en controleer uw inzending goed.<br>Wij wijzen u erop dat niet alle inzendingen kunnen worden geplaatst.<br>Uw inzending wordt gecontroleerd op grammatica en kan bewerkt of ingekort worden.");


define("_SUBTITLE","Titel");


define("_BEDESCRIPTIVE","Gebruik korte, samengevatte tekst");


define("_BADTITLES","geen titels als: 'Check This Out!' of 'Zie Dit!' e.d.");


define("_HTMLISFINE","HTML is toegstaan, maar controleer goed evt. URLs en HTML-tags!");


define("_AREYOUSURE","Heeft u de goede URL ingevuld, zonder tikfouten?");


define("_SUBPREVIEW","U moet het artikel één keer controleren (voorbeeld), voordat U het kunt inzenden");


define("_SELECTTOPIC","Selecteer onderwerp");


define("_NEWSUBPREVIEW","Nieuws inzending voorbeeld");


define("_STORYLOOK","Uw inzending zal er zo uitzien:");


define("_CHECKSTORY","Controleer tekst, links, enz. voordat u uw verhaal verzendt!");


define("_THANKSSUB","Bedankt voor uw inzending!");


define("_SUBSENT","Uw inzending is ontvangen.");


define("_SUBTEXT","Uw inzending zal worden bekeken. Incorrecte en beledigende bewoordingen worden niet gepubliceerd.");


define("_WEHAVESUB","Op dit ogenblik hebben wij");


define("_WAITING","inzendingen die op publicatie wachten.");


define("_PREVIEW","Voorbeeld");


define("_NEWUSER","Nieuwe gebruiker");


define("_USCORE","Score");


define("_DATE","Datum");


define("_STORYTEXT","Verhaaltekst");


define("_EXTENDEDTEXT","Verlengde tekst");


define("_LANGUAGE","Taal");


define("_SELECTMONTH2VIEW","Kies de maand dat u wenst te bekijken:");


define("_SHOWALLSTORIES","Toon ALLES");


define("_STORIESARCHIVE","Archief");


define("_ACTIONS","Acties");


define("_ARCHIVESINDEX","Archief Index");


define("_ALLSTORIESARCH","Alles");


define("_NEXTPAGE","Volgende Pagina");


define("_PREVIOUSPAGE","Vorige Pagina");





?>