OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Good Patch to Multiple [XSS] Vulnerabilities in PHP-Nuke 7.4

From: Pierquinto Manco (pierquintogmail.com)
Date: Mon Sep 06 2004 - 14:56:43 CDT

**************************************************************
* CODEBUG Labs
* Patch #1
* Title: Multiple XSS Bug in admin.php
* Author: Pierquinto 'Mantra' Manco
* Product: PHP-Nuke 7.4
* Web: http://www.mantralab.org
*
* Register to our site and receive our newsletter!
**************************************************************

- ) Patch

Apply this code to your admin.php file:

if ( !empty($HTTP_GET_VARS['admin']) ) {
        die("Shit! Mantra wins =)");
}

if ( !empty($HTTP_POST_VARS['admin']) ) {
        die("Shit! Mantra wins =)");
}

-) Note
Previous patch isn't enough performant.
Try this one.
There are a lot of this problem in PHP-Nuke 7.4, my patch will check
the content of $_POST[admin] and $_GET[admin].
I'm going to post all this vulnerabilities on my site...
http://www.mantralab.org

**************************************************************
                http://www.mantralab.org
**************************************************************