[Full-Disclosure] Re: XSS in Postnuke Rogue release (0.72)

From: Rick Updegrove (dislistsat_private)
Date: Mon Nov 11 2002 - 23:17:55 PST

Next message: Tamer Sahin: "[SecurityOffice] Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability"

Previous message: securityat_private: "Security Update: [CSSA-2002-044.0] Linux: Preboot eXecution Environment (PXE) server denial-of-service attacks"
In reply to: Muhammad Faisal Rauf Danka: "[Full-Disclosure] XSS in Postnuke Rogue release (0.72)"
Next in thread: Muhammad Faisal Rauf Danka: "[Full-Disclosure] XSS in Postnuke Rogue release (0.72)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----- Original Message -----
From: "Muhammad Faisal Rauf Danka" <mfrdat_private>
To: <bugtraqat_private>; <full-disclosureat_private>;
<vulnwatchat_private>
Sent: Thursday, November 07, 2002 10:49 PM
Subject: XSS in Postnuke Rogue release (0.72)


> On postnuke’s own website this issue is handled very
> effectively by bouncing the user back to the  > “./index.php”
> without giving any errors, thus reducing the chances of webroot
> disclosure too. I hope such functionality be added to the
> downloadable version of postnuke’s latest
> build too for the benefit of the users.

http://developers.postnuke.com/modules.php?op=modload&name=Downloads&file=in
dex&req=viewdownload&cid=1

This patch also emails the site admin with an impressive "possible hack
attempt" notice.  I installed the 2 files and my site is no longer
vulnerable.


Rick Up

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Next message: Tamer Sahin: "[SecurityOffice] Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability"
Previous message: securityat_private: "Security Update: [CSSA-2002-044.0] Linux: Preboot eXecution Environment (PXE) server denial-of-service attacks"
In reply to: Muhammad Faisal Rauf Danka: "[Full-Disclosure] XSS in Postnuke Rogue release (0.72)"
Next in thread: Muhammad Faisal Rauf Danka: "[Full-Disclosure] XSS in Postnuke Rogue release (0.72)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Nov 12 2002 - 00:33:05 PST