Do any one have Security Fix for 5.6?

Posted: Tue Feb 04, 2003 8:24 pm

Do anyone have Security fix for phpnuke5.6?

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Its quite easy actually for 5.x and 6.x. Just replace in index.php:

#if (ereg("\.\.",$name) || ereg("\.\.",$file)) {

with

if (ereg("\.\.",$name) || ereg("\.\.",$file) || ereg("\.\.", $mod_file) || ereg("\.\.", $mop)) {

In mainfile.php add after <?php:

if (ereg("\\'",base64_decode($admin)) || ereg("\\'",base64_decode($user))) {
die("I don't like you");
}

I myself haven't made changes to modules.php since modpath is set thus:

$modpath="modules/$name/$file.php";
if (file_exists($modpath)) {
include($modpath);
} else {
die ("Sorry, such file doesn't exist...");
}