https://www.exploit-db.com/exploits/25799
https://www.securityfocus.com/bid/89889
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200506-072

FlatNuke2.5.3中，某些脚本中的无效参数在出错信息中泄漏了web文档根目录，远程攻击者可利用此漏洞获得敏感信息。

source: http://www.securityfocus.com/bid/13882/info

Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.

An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

http://www.example.com/flatnuke/index.php?mod=none_Search&find=1&where=null

FlatNuke FlatNuke 2.5.3

来源:VUPEN
名称:ADV-2005-0697
链接:http://www.frsirt.com/english/advisories/2005/0697
来源:MISC
链接:http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt
来源:SECTRACK
名称:1014114
链接:http://securitytracker.com/id?1014114
来源:SECUNIA
名称:15603
链接:http://secunia.com/advisories/15603
来源:flatnuke.sourceforge.net
链接:http://flatnuke.sourceforge.net/index.php?mod=read&id;=1117979256