waraxe Advisory #33 released Wed Jun 23, 2004 12:07 am

Posted: Wed Jun 23, 2004 8:47 pm

Only registered users can see links on this board! Get registered or login!

Quote:

Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

There are various security flaws - full path disclosure, xss, script injection and critical sql injection. Most of the bugs, dicussed in current advisory, are located in "Journal" module, and couple of full path disclosure bugs are in "Web_Links" and "Statistics" modules.

Original can be viewed here:

http://www.waraxe.us/?modname=sa&id=033

Patching tutorial:

http://www.waraxe.us/forum/viewtopic.php?t=171

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

See my news item on the front page Smile

Posted: Wed Jun 23, 2004 10:49 pm

Nuke Patched 2.5 takes care of the Web Links and Statistics modules issues but only of some of the vulnerabilities found in the Journal module, i would actually suggest disabling it for the time being.

Hangin' Around Joined: Jun 05, 2004 Posts: 41

Ok journal disabled Laughing

All others are ok