Would this affect PHPNUKE

New Member Joined: Apr 11, 2005 Posts: 21

Hi

please see post from Netcraft:

Quote:

Many popular PHP-based blogging, wiki and content management programs can be exploited through a security hole in the way PHP programs handle XML commands. The flaw allows an attacker to compromise a web server, and is found in programs including PostNuke, WordPress, Drupal, Serendipity, phpAdsNew, phpWiki and phpMyFAQ, among others.

The flaw affects the XML-RPC function, which has many uses in web applications, including "ping" update notifications for RSS feeds. PHP libraries that allow applications to exchange XML data using remote procedure calls(RPC) fail to fully check incoming data for malicious commands. The affected libraries, including PHPXMLRPC and Pear XML-RPC, are included in many interactive applications written in PHP.

The XML-RPC flaw was discovered by James Bercegay of GulfTech Security Research. Bercegay found that the libraries are "vulnerable to a very high risk remote php code execution vulnerability that may allow for an attacker to compromise a vulnerable webserver ... By creating an XML file that uses single quotes to escape into the eval() call an attacker can easily execute php code on the target server."

Updated copies of the libraries are now available, and immediate upgrades are recommended. The nature of the flaw poses a dilemma for site operators on shared hosting services, who may run affected applications on their sites but not have the ability to update the server's PHP installation with the secure libraries. Disabling XML-RPC features is the recommended workaround.

source:

http://news.netcraft.com/archives/2005/07/04/php_blogging_apps_vulnerable_to_xmlrpc_exploits.html

would this affect modules like NukeAmazon and the RSS function in PHPNuke?

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

See also http://www.php.net/. Be sure to have your host update their installation immediately. It's a simple 2 second update Smile

phpnuke does not utilize these functions. As to NukeAmazon, I do not have that module and the site is having problems so I can't d/l it to take a look. If it uses any functions that begin with xmlrpc_ then it mat be affected.

Posted: Tue Jul 05, 2005 1:36 pm

thanks

I'll check the amazon module and I'll let my host know, well they probably know already coz they "supposed to be quite good".