751c749
function saveuser($realname, $email, $femail, $url, $user_avatar, $newsletter, $user_icq, $user_aim, $user_yim, $user_msnm, $user_from, $user_occ, $user_intrest, $user_sig, $bio, $pass, $vpass, $uname, $uid, $attach) {
775c773
sql_query("UPDATE ".$user_prefix."_users SET name='$realname', email='$email', femail='$femail', url='$url', pass='$pass', bio='$bio' , user_icq='$user_icq', user_occ='$user_occ', user_from='$user_from', user_intrest='$user_intrest', user_sig='$user_sig', user_aim='$user_aim', user_yim='$user_yim', user_msnm='$user_msnm', newsletter='$newsletter' WHERE uid='$uid'");
---
> $db->sql_query("UPDATE ".$user_prefix."_users SET name='$realname', email='$email', femail='$femail', url='$url', pass='$pass', bio='$bio' , user_avatar='$user_avatar', user_icq='$user_icq', user_occ='$user_occ', user_from='$user_from', user_intrest='$user_intrest', user_sig='$user_sig', user_aim='$user_aim', user_yim='$user_yim', user_msnm='$user_msnm', newsletter='$newsletter' WHERE uid='$uid'");
786c784
sql_query("UPDATE ".$user_prefix."_users SET name='$realname', email='$email', femail='$femail', url='$url', bio='$bio', user_icq='$user_icq', user_occ='$user_occ', user_from='$user_from', user_intrest='$user_intrest', user_sig='$user_sig', user_aim='$user_aim', user_yim='$user_yim', user_msnm='$user_msnm', newsletter='$newsletter' WHERE uid='$uid'");
---
> $db->sql_query("UPDATE ".$user_prefix."_users SET name='$realname', email='$email', femail='$femail', url='$url', bio='$bio', user_avatar='$user_avatar', user_icq='$user_icq', user_occ='$user_occ', user_from='$user_from', user_intrest='$user_intrest', user_sig='$user_sig', user_aim='$user_aim', user_yim='$user_yim', user_msnm='$user_msnm', newsletter='$newsletter' WHERE uid='$uid'");
1174c1172
saveuser($realname, $email, $femail, $url, $user_avatar, $newsletter, $user_icq, $user_aim, $user_yim, $user_msnm, $user_from, $user_occ, $user_intrest, $user_sig, $bio, $pass, $vpass, $uname, $uid, $attach);
1223c1221

---
> ?>

This is a follow up to my original email..

First of all i just want to add, that with this vulnerability, it is
possible to change other user's avatars to either text, or to different
images. all you need to find out is their UID and username.

And also i came up with this solution for the problem..

In modules/Your_Account in php nuke, open up index.php. Search for
"saveuser" you should get to a function that looks liek this..
(should be around line 740)

function saveuser($uid, $realname, $uname, $email, etc...

right underneath the function call, put this in..

$referer = getenv("HTTP_REFERER");
$nukeurl="http://digital-delusions.com";
$nukeurl2="http://digital-delusions.dyn.ee";
$nukeurl3="http://192.168.0.254";
if (substr("$referer",0,strlen($nukeurl))==$nukeurl OR
substr("$referer",0,strlen($nukeurl2))==$nukeurl2 OR
substr("$referer",0,strlen($nukeurl3))==$nukeurl3) {

this code will check where the request is coming from, and if it is coming
from your site, then it will let the function continue.. Notice i have 3
$nukeurl variables, this is because those are the 3 different url's requests
can come form. So make sure u change my URLs to your site's urls.

Then, go down to the end of the function.. (ends with a "}")
should look somethign liek this..

[...]
Header("Location: modules.php?name=$module_name");
}
}
}

before the last "}"
paste this..

} else {
echo "delusion ownz j00";
}

make sure u keep all the {}'s in their correct places, dont remove any. and
of course you can change the message to whatever you want ;)

Have fun,
-delusion
http://www.digital-delusions.com