leopoldm writes:  

Apachefriends need our help for their XAMPP project : please read the article
Greetz,

Leopold

Security patch for PHP-Nuke 7.0 and 7.1 designed to secure the Reviews, Search, Sections and Surveys modules against a vulnerability being exploited in the same fashion the Downloads and Web_Links modules were compromised a while back.

Downloads: PHP-Nuke 6.5-6.9 - PHP-Nuke 7.0 - PHP-Nuke 7.1

Note: 

Updated - Added diff files in html format.

Please! Check your modules/Reviews/index.php file for the following code. There should be 2 instances.

WHERE id=$id

If you have it, then you MUST modify it to

WHERE id='$id' .

Otherwise your admin passwords can be exposed. They are still encrypted, but depending on how serious someone was to get them, they might! please note that Chatserv's Patches have this fix in them, but FB should have patched his releases by now and hasn't!

Admin Note: See this post for further discussion and code for protecting your site.

Additional variable validation added to the Surveys, Sections, Reviews and Search modules, corrected some core bugs in versions 7.0 and 7.1. For those that don't know what PHP-Nuke Patched is, these are not full packs, not all files are included, only those that have been secured. These files attempt to secure PHP-Nuke as best as humanly possible by providing variable validation to help avoid sql injection code to be inserted and also helps by authenticating the url address used in many cases to block intentionally altered browser address urls. I had made some modifications to the previous version but had not changed the version number as the changes were minor and did not warrant it, this time the changes do merit a new version so here it is

Download locations:
Nuke 6.0 · Nuke 6.5 · Nuke 6.6-6.8 · Nuke 6.9 · Nuke 7.0 and Nuke 7.1

PHP-Nuke 7.1 Final version from phpnuke.org.

The author writes "This version includes the highly requested subscription system. Now you can manage annual subscription specialy designed to remove advertising, hide blocks and grant access to certain restricted modules (defined by the admin) for your subscribed users. Also included many minor bugs fixed." Read on for a list of the changes. Read More...

I have been comparing the public release of phpnuke v7.0 (released today at phpnuke.org) with my customized release and I will be releasing an update soon. The only major change is that Web Mail has returned. Other than that there are only a couple of changes, mostly concerning the Survey module scripts and Banners. There are no SQL changes at all. I will be releasing both a full pack and a diff pack of some kind.