----------------------------------------------------------------------

Secunia is pleased to announce the release of the annual Secunia
report for 2008.

Highlights from the 2008 report:
 * Vulnerability Research
 * Software Inspection Results
 * Secunia Research Highlights
 * Secunia Advisory Statistics

Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/

Stay Secure,

Secunia


----------------------------------------------------------------------

TITLE:
FlatnuX CMS Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA34811

VERIFY ADVISORY:
http://secunia.com/advisories/34811/

DESCRIPTION:
girex has discovered some vulnerabilities in FlatnuX CMS, which can
be exploited by malicious people to disclose sensitive information
and by malicious users to compromise a vulnerable system.

1) Input passed to the "module" parameter in
sections/02_Flatforum/search.php and sections/08_Files/search.php, to
the "_FNVMOD" parameter in sections/06_Download/section.php, the
"_FN[vmod]" parameter in sections/10_Login/section.php and
none_Control_Center/section.php, and to the "_FN[theme]" parameter in
themes/tp_alpha/theme.php, themes/tp_dhtml2/theme.php, and
themes/tp_green/theme.php is not properly verified before being used
to include files. This can be exploited to include arbitrary files
from local resources.

Successful exploitation allows to execute arbitrary PHP code e.g. via
an uploaded avatar image, but requires that "register_globals" is
enabled and "magic_quotes_gpc" is disabled.

2) The application does not properly check the file extensions of
uploaded files. This can be exploited to upload and execute arbitrary
PHP code e.g. via ".phtml" files.

Successful exploitation requires valid user credentials.

The vulnerabilities are confirmed in version 2009-03-27. Other
versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly verified. Grant
only trusted users access to the application.

PROVIDED AND/OR DISCOVERED BY:
girex

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/8483

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------