Nuked-klaN 1.3 - Remote Information Disclosure

Author: gregory Le Bras
type: webapps
platform: php
port: 
date_added: 2003-02-23 
date_updated: 2012-10-27 
verified: 1 
codes: CVE-2003-1371;OSVDB-52891 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/6917/info

A vulnerability has been discovered in Nuked-Klan which may be exploited to execute certain PHP functions on a target server. This issue occurs in the 'Team', 'News', and 'Lien' modules and is due to insufficient sanitization of user-supplied URI parameters.

This issue may be exploited by a remote attacker to obtain sensitive server information, which could aid in launching further attacks against a target system.

The vulnerability was reported for Nuked-Klan beta 1.3; earlier versions may also be affected.

http://www.example.org/index.php?file=Team&op=phpinfo
http://www.example.org/index.php?file=News&op=phpinfo
http://www.example.org/index.php?file=Liens&op=phpinfo