Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a .. (dot dot) in the func parameter to index.php.

Postnuke Security Announcementss reports of the following vulnerabilities :

- missing input validation within /modules/Messages/readpmsg.php

- possible path disclosure within /user.php

- possible path disclosure within /modules/News/article.php

- possible remote code injection within /includes/pnMod.php

- possible cross-site-scripting in /index.php

- remote code injection via xml rpc library

The remote host is running PostNuke version 0.760 RC4a or older. These versions suffer from several vulnerabilities, among them :

  - Multiple Remote Code Injection Vulnerabilities     An attacker can read arbitrary files on the remote and     possibly inject arbitrary PHP code remotely.

  - SQL Injection Vulnerabilities     Weaknesses in the 'Xanthia' and 'Messages' modules allow     attackers to affect database queries, possibly resulting     in the disclosure of sensitive information such as user     passwords and even execution of arbitrary PHP code on     the remote host.

  - Multiple Cross-Site Scripting Vulnerabilities     An attacker can inject arbitrary script code into the     browser of users leading to disclosure of session     cookies, redirection to other sites, etc.

  - Multiple Path Disclosure Vulnerabilities     An attacker can discover details about the underlying     installation directory structure by calling various     include scripts directly.

The remote host is running PostNuke version 0.760 RC3 or older.  This version of PostNuke is vulnerable to a remote Cross-Site Scripting (XSS) flaw.  Specifically, failure to parse malicious input to the 'op' parameter of the user.php script or the 'module' parameter of the admin.php script can lead to the injection of script code.  An attacker exploiting this flaw would need to be able to entice the victim into browsing a malicious URI.  Successful exploitation would result in the attacker being able to inject arbitrary script code into the browser of the unsuspecting user.  This can lead to disclosure of confidential information.  In addition, the remote host is vulnerable to a remote SQL Injection attack.  An attacker exploiting this flaw would be able to read/write confidential database data.

ID	Name	Product	Family	Severity
21379	FreeBSD : postnuke -- multiple vulnerabilities (0274a9f1-0759-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
18360	PostNuke <= 0.760 RC4a Multiple Vulnerabilities	Nessus	CGI abuses	high
2808	PostNuke < 0.760 RC4 Multiple XSS and SQL Injection Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2005-1621

high

Tenable Plugins

high

high

high