Nuke Patched - May 3, 2004 Update

Posted: Mon May 03, 2004 8:40 am

XSS and full path disclosure in PhpNuke Reported by waraxe.

Open all files (except .htaccess and index.html) contained in admin/links and add the following right after the file credits:

Code:

if (!eregi("admin.php", $_SERVER['PHP_SELF'])) { die ("Access Denied"); }

Open modules/Statistics/index.php and find:

Code:

$pagetitle = "- "._STATS."";

Right below that line add:

Code:

if (isset($year)) {


    $year = intval($year);


}

The patches have yet to be updated so apply these manually, i will update them ASAP, my thanks to Sting for the heads up.

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

Thanks Sting and Chatserv!

Posted: Mon May 03, 2004 9:07 am

Thanks Raven.

Users of the 6.0 patch may need to alter the admin/links line posted above if their php version is old, the line in this case would be:

Code:

if (!eregi("admin.php", $PHP_SELF)) { die ("Access Denied"); }

Posted: Mon May 03, 2004 9:59 am

I can sleep easy at night because of your patches chatserv. Shocked

Hangin' Around Joined: Mar 22, 2004 Posts: 49

Yeah thanks m8, I just patched all mine now too Smile

Client Joined: Apr 10, 2004 Posts: 649 Location: UK

Are these added to the latest patched files download Chat? Or do we have to add them ourselves?

Thanks for keeping us safe

Posted: Sun Aug 01, 2004 7:28 pm

Yes they were added.

Posted: Mon Aug 02, 2004 7:09 am

thank you Chat