Exploit FlatNuke 2.5.x - 'index.php?where' Full Path Disclosure

[Exploiter]

EDB-ID

25799

Проверка EDB

1. Пройдено

Автор

SECWATCH

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2005-1893

Дата публикации

2005-06-07

source: https://www.securityfocus.com/bid/13882/info

Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.

An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

http://www.example.com/flatnuke/index.php?mod=none_Search&find=1&where=null