#16: Re: Posted on Bugtraq -CPGNuke Dragonfly 9.0.6.1 remote commands Author: DJ Maze, Location: http://tinyurl.com/5z8dmvPosted: Sun Feb 12, 2006 4:20 am ---- Yes those 4 files will patch your system.
About the exploit:
coppermine OR error.php is used to send over a script.
The script CAN'T run on its own so it needs a file that has a bug.
install.php has such bug in the language selector.
If you properly deleted the install.php per the instructions said, then your system is not vulnerable.
Since both the readme and the installer say it, this exploit is actualy "low-risk". But since nobody does what they read or skip to read i've put it up as update notification.
The XSS exploit i discovered in linking.php is of a much more severe security issue. Therefore the update notification is fully in its right.
#17: Re: Posted on Bugtraq -CPGNuke Dragonfly 9.0.6.1 remote comm Author: Ronin, Location: Calgary, ABPosted: Sun Feb 12, 2006 8:50 pm ----
DJMaze wrote:
The XSS exploit i discovered in linking.php is of a much more severe security issue. Therefore the update notification is fully in its right.
OK, I did follow the install instructions and removed install.php. However I'm not clear if the linking.php issue mentioned above is seperate? My update notification just talks about removing the install, with no mention of an XSS exploit in linking.php.
Quote:
install.php security exploitRecently someone found a security exploit in install.php.
Always be shure you deleted install.php.
Fixes available at dragonflycms.org/Forum...html#98034
Posted on February 10, 2006
So can someone clarify that if I don't have install.php I'm safe from everything discussed here including the linking.php XSS exploit?
#18: Re: Posted on Bugtraq -CPGNuke Dragonfly 9.0.6.1 remote comm Author: goran_wright, Location: PhilippinesPosted: Tue Feb 14, 2006 7:47 am ----
Quote:
install.php security exploitRecently someone found a security exploit in install.php.
Always be shure you deleted install.php.
Fixes available at dragonflycms.org/Forum...html#98034
Posted on February 12, 2006
I also have this message. but I don't have instll.php..
#19: Re: Posted on Bugtraq -CPGNuke Dragonfly 9.0.6.1 remote commands Author: Ronin, Location: Calgary, ABPosted: Tue Feb 14, 2006 2:21 pm ---- The message is just an advisory goran. Everyone running 9.0.6.1 gets it.
