----- Original Message ----- From: "Muhammad Faisal Rauf Danka" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, November 07, 2002 10:49 PM Subject: XSS in Postnuke Rogue release (0.72)
> On postnuke’s own website this issue is handled very > effectively by bouncing the user back to the > “./index.php” > without giving any errors, thus reducing the chances of webroot > disclosure too. I hope such functionality be added to the > downloadable version of postnuke’s latest > build too for the benefit of the users. http://developers.postnuke.com/modules.php?op=modload&name=Downloads&file=in dex&req=viewdownload&cid=1 This patch also emails the site admin with an impressive "possible hack attempt" notice. I installed the 2 files and my site is no longer vulnerable. Rick Up _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
