Waraxe IT Security Portal
Login or Register
July 23, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 226
Members: 0
Total: 226
Full disclosure
CyberDanube Security Research 20240722-0 | Multiple Vulnerabilities in Perten/PerkinElmer ProcessPlus
[KIS-2024-06] XenForo <= 2.2.15 (Template System) Remote Code Execution Vulnerability
[KIS-2024-05] XenForo <= 2.2.15 (Widget::actionSave) Cross-Site Request Forgery Vulnerability
CVE-2024-33326
CVE-2024-33327
CVE-2024-33328
CVE-2024-33329
CyberDanube Security Research 20240703-0 | Authenticated Command Injection in Helmholz Industrial Router REX100
SEC Consult SA-20240627-0 :: Local Privilege Escalation via MSI installer in SoftMaker Office / FreeOffice
SEC Consult SA-20240626-0 :: Multiple Vulnerabilities in Siemens Power Automation Products
Novel DoS Vulnerability Affecting WebRTC Media Servers
APPLE-SA-06-25-2024-1 AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8
40 vulnerabilities in Toshiba Multi-Function Printers
17 vulnerabilities in Sharp Multi-Function Printers
SEC Consult SA-20240624-0 :: Multiple Vulnerabilities allowing complete bypass in Faronics WINSelect (Standard + Enterprise)
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> PhpNuke -> New phpnuke security advisories will be out very soon!
Post new topicReply to topic View previous topic :: View next topic
New phpnuke security advisories will be out very soon!
PostPosted: Tue Feb 14, 2006 5:05 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Yes, it's true. More Phpnuke holes revealed, so stay in touch! Wink


Last edited by waraxe on Fri Apr 13, 2007 4:20 pm; edited 1 time in total
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Tue Feb 14, 2006 5:34 pm Reply with quote
Heintz
Valuable expert
Valuable expert
Joined: Jun 12, 2004
Posts: 88
Location: Estonia/Sweden




firstable, great work on last advisory.
will be interesting to read the coming ones. hopefully software author respond more sensibly too Smile

_________________
AT 14:00 /EVERY:1 DHTTP /oindex.php www.waraxe.us:80 | FIND "SA#037" 1>Nul 2>&1 & IF ERRORLEVEL 0 "c:program filesApache.exe stop & DSAY alarmaaa!"
View user's profile Send private message Send e-mail Visit poster's website MSN Messenger
PostPosted: Tue Feb 14, 2006 9:03 pm Reply with quote
zer0-c00l
Advanced user
Advanced user
Joined: Jun 25, 2004
Posts: 72
Location: BRAZIL!




Good to see you Waraxe Very Happy
View user's profile Send private message
Re: New phpnuke security advisories will be out very soon!
PostPosted: Tue Feb 14, 2006 10:25 pm Reply with quote
cXIb8O3
Active user
Active user
Joined: Feb 17, 2005
Posts: 26
Location: Poland<>Luxembourg




waraxe wrote:
Yes, it's true. More Phpnuke holes revealed, so stay in touch! Wink


Yeah.. phpnuke Smile something critical? i hope.. i have something in phpnuke.. but i don't like phpnuke... Smile Postnuke is 100% better :]
View user's profile Send private message Visit poster's website
PostPosted: Wed Feb 15, 2006 1:34 am Reply with quote
shai-tan
Valuable expert
Valuable expert
Joined: Feb 22, 2005
Posts: 477




Or how about "No Nuke" ? lolz.

_________________
Shai-tan

?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds
View user's profile Send private message
PostPosted: Thu Feb 16, 2006 10:44 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Heh, i was going to publish 2 advisories, 1 is not critical and 1 is possible critical, but not the best. But just accidentially, lurking in phpnuke src, i found very interesting sql injection case Shocked
Just some minutes ago tested it in real world, and it works in many servers Wink
Weeee, i like phpnuke Laughing
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Fri Feb 17, 2006 6:54 am Reply with quote
shai-tan
Valuable expert
Valuable expert
Joined: Feb 22, 2005
Posts: 477




Yes I remember you explaining to me once why you "like" it. Razz

The likes of phpbb and phpnuke hate anyone from outside finding Vulns no matter what the intention is of the founder. Just Arrogant bastards if you ask me.

_________________
Shai-tan

?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds
View user's profile Send private message
PostPosted: Fri Feb 17, 2006 12:08 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Phpbb developers are nice people and they really care about security. But phpnuke - this is another case. It is too "fuzzy" project, there are too many webmasters, coders and wannabe programmers, who all try to add some functionality and modify something. All the phpnuke src is filled with legacy code fragments. By looking at nuke src, it seems like good old phpnuke 4.x or 5.x days. What a mess. It is time to rewrite this code from scratch. But Burzi seems to be too lazy for this Razz
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sat Feb 18, 2006 2:30 am Reply with quote
shai-tan
Valuable expert
Valuable expert
Joined: Feb 22, 2005
Posts: 477




I dont like the phpbb developers they are arrogant but they are better than the phpnuke ones.

_________________
Shai-tan

?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds
View user's profile Send private message
PostPosted: Sat Feb 18, 2006 2:40 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




Just posted new advisory:

http://www.waraxe.us/advisory-45.html

Next one will be out tomorrow and it's about sql injection bug Wink
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Sun Feb 19, 2006 3:55 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




So here it is, advisory about critical sql injection in phpNuke:

http://www.waraxe.us/advisory-46.html

Enjoy Very Happy

P.S. Next advisory will be about some XSS cases and after that - reincarnation of very old and very nasty security hole Smile

Stay in touch!! Wink
View user's profile Send private message Send e-mail Visit poster's website
New phpnuke security advisories will be out very soon!
www.waraxe.us Forum Index -> PhpNuke
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.124 Seconds