Release Date: 2004-02-11
Critical: Moderately critical
Impact: Security Bypass
Where: From remote
Software: PHP-Nuke 5.x, PHP-Nuke 6.x, PHP-Nuke 7.x
Description:
pokleyzz has reported two vulnerabilities in PHP-Nuke, allowing malicious people to conduct SQL injection attacks.
1) The "Search" module fails to verify input passed to the "category" parameter properly before it is used in a SQL query. This can be exploited to manipulate SQL queries.
2) The "Web_Links" module fails to verify input passed to the "admin" parameter properly before it is used in a SQL query. This can be exploited to manipulate SQL queries.
A proof of concept exploit exploiting these vulnerabilities to enumerate the administrative password hash has been published.
The vulnerabilities have been reported in versions 5.x, 6.x and possibly 7.x.
Solution:
Edit the source to ensure that input is properly verified.
Use another product.
Provided and/or discovered by:
pokleyzz
Original Advisory:
http://www.scan-associates.net/papers/phpnuke69.txt
Source: Secunia