PHP-Nuke Path Disclosure Vulnerability

Në vazhdim po përcjell mesazhin mbi zbulimin e një dobësie tjetër në CMS Php-Nuke, gjithmonë në lidhje me sigurinë e këtij sistemi:

Subject: PHP-Nuke Path Disclosure Vulnerability
Date: 15:56, e shtunë 18 tetor 2003
From: Bahaa Naamneh
To: bugtraq@securityfocus.com

PHP-Nuke Path Disclosure Vulnerability

Published: 18 October 2003

Released: 16 October 2003

Affected Systems: PHP-Nuke 7.0 (and possibly earlier versions).

Vendor: http://www.phpnuke.org

Description:
============
PHP-Nuke is a Web Portal System, storytelling software, news system,online community or whatever you want to call it.Its goal is to have an automated web site to distribute news andarticles with user system.

Details:
========
It's possible to disclose potentially sensitive installation pathinformation to the remote attacker by using ("') " and ' chars in thesearch textbox : http://[Site]/modules.php?name=Searchor we can use this chars " and > and ' this chars will cause adisclosure of the installation path and the text will protrusion outof the search textbox.

Vendor status:
==============
The vendor has been informed.

Discovered by / credit:
=======================
Bahaa Naamneh
b_naamneh@hotmail.com
http://www.bsecurity.tk

-------------------------------------------------------