|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[SA11341] Nuked-KlaN Arbitrary File Inclusion
From: Secunia Security Advisories (sec-adv
secunia.com)
Date: Mon Apr 12 2004 - 13:05:29 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
TITLE:
Nuked-KlaN Arbitrary File Inclusion
SECUNIA ADVISORY ID:
SA11341
VERIFY ADVISORY:
http://secunia.com/advisories/11341/
CRITICAL:
Moderately critical
IMPACT:
Manipulation of data, Exposure of sensitive information, DoS
WHERE:
From remote
SOFTWARE:
Nuked-Klan 1.x
DESCRIPTION:
frog-mn has reported two vulnerabilities in Nuked-KlaN, allowing
malicious people to include arbitrary scripts and corrupt the
configuration file.
User input passed to the "user_langue" parameter in "index.php" is
not properly verified before being used to include files. This can be
exploited to include arbitrary scripts and files from local
resources.
It is possible to overwrite globally defined variables defined in the
configuration file. This can be exploited to cause unexpected
behaviour and potentially corrupt the configuration file.
This has been reported to affect version 1.5b and prior.
SOLUTION:
Edit the source code to ensure that input passed to the "user_langue"
parameter is properly sanitised.
PROVIDED AND/OR DISCOVERED BY:
frog-mn
ORIGINAL ADVISORY:
http://www.phpsecure.info/v2/tutos/frog/Nuked-KlaN.txt
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
----------------------------------------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]