Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: PHP :: bt1295.txt

PHP-Nuke Path Disclosure Vulnerability

PHP-Nuke Path Disclosure Vulnerability

Published: 18 October 2003

Released: 16 October 2003

Affected Systems: PHP-Nuke 7.0 (and possibly earlier versions).




PHP-Nuke is a Web Portal System, storytelling software, news system,

online community or whatever you want to call it. 

Its goal is to have an automated web site to distribute news and

articles with user system. 



It's possible to disclose potentially sensitive installation path

information to the remote attacker by using ("') " and ' chars in the

search textbox : http://[Site]/modules.php?name=Search

or we can use this chars " and > and ' this chars will cause a

disclosure of the installation path and the text will protrusion out

of the search textbox.

Vendor status:


The vendor has been informed.

Discovered by / credit:


Bahaa Naamneh

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH