-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Bypass XSS filter in PHPNUKE 7.9=>x cXIb8O3.21] Author: Maksymilian Arciemowicz ( cXIb8O3 ) Date: 14.12.2005 from SECURITYREASON.COM - --- 0.Description --- PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it. Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit comments to discuss the articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment, statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner system, backend/headlines generation, Yahoo like search engine, Ephemerids manager, file manager, download manager, faq manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password encryption, phpBB Forums integration, support for 25 languages, 100% modular and more. Written 100% in PHP and requires Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others. - --- 1. Bypass XSS filter --- In PHPnuke is (file includes/mainfile.php). - -168-193--- if (!defined('ADMIN_FILE') && !file_exists('includes/nukesentinel.php')) { foreach ($_GET as $sec_key => $secvalue) { if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*style*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("$[^>]*\"?[^)]*$", $secvalue)) || (eregi("\"", $secvalue)) || (eregi("forum_admin", $sec_key)) || (eregi("inside_mod", $sec_key))) { die ($htmltags); } } foreach ($_POST as $secvalue) { if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) { die ($htmltags); } } } - -168-193--- This functions deletes from input html tags like: -