|
|
|
|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 118
Members: 0
Total: 118
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
possible point of exploiting - statistics - phpNuke 7.5 |
|
Posted: Sun Nov 28, 2004 4:39 pm |
|
|
D3ADLiN3 |
Regular user |
|
|
Joined: Nov 21, 2004 |
Posts: 6 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Posted: Sun Nov 28, 2004 5:20 pm |
|
|
D3ADLiN3 |
Regular user |
|
|
Joined: Nov 21, 2004 |
Posts: 6 |
|
|
|
|
|
|
|
ok bit further playing and another possible hole:
Example:
http://www.victim.com/modules.php?name=Statistics&op=MonthlyStats&year=2004&month=13
Result:
'Daily Stats for , 2004'
Bad Code:
Code: |
function getmonth($month){
if ($month == 1) echo ""._JANUARY."";
if ($month == 2) echo ""._FEBRUARY."";
if ($month == 3) echo ""._MARCH."";
if ($month == 4) echo ""._APRIL."";
if ($month == 5) echo ""._MAY."";
if ($month == 6) echo ""._JUNE."";
if ($month == 7) echo ""._JULY."";
if ($month == 8) echo ""._AUGUST."";
if ($month == 9) echo ""._SEPTEMBER."";
if ($month == 10) echo ""._OCTOBER."";
if ($month == 11) echo ""._NOVEMBER."";
if ($month == 12) echo ""._DECEMBER."";
}
|
No Error Handling! |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpNuke
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|