Waraxe IT Security Portal

mircia · Regular user

I was wondering... is it possible to do something else with php-nuke : e.g. uploading a web-shell (system($cmd); something like that), maybe something more useful....

waraxe · Site admin

If you use remote file inclusion sploits, then you can give any commands to shell (if there is no restrictions, like safe mode, etc...). Another method is, when you use mysql file handling functions (it's possible only, when current mysql user has file permissions) to create in victim server script files with content you needed.
And one more thing - there are many phpnuke add-on modules with security flaws, where you can get remote file inclusion sploits to work. For example popular picture gallery - Coppermine - which (if unpatched) gives many possibilities to potential attacker.

mircia · Regular user

Maybe you can give a link (or example) to this issue?

waraxe · Site admin

Here is the Coppermine advisory:

http://www.waraxe.us/?modname=sa&id=026