Secunia Advisory: SA10843 Print Advisory
Release Date: 2004-02-11

Critical: Moderately critical
Impact: Security Bypass
Where: From remote

Software: PHP-Nuke 5.x, PHP-Nuke 6.x, PHP-Nuke 7.x


Description:
pokleyzz has reported two vulnerabilities in PHP-Nuke, allowing malicious people to conduct SQL injection attacks.

1) The "Search" module fails to verify input passed to the "category" parameter properly before it is used in a SQL query. This can be exploited to manipulate SQL queries.

2) The "Web_Links" module fails to verify input passed to the "admin" parameter properly before it is used in a SQL query. This can be exploited to manipulate SQL queries.

A proof of concept exploit exploiting these vulnerabilities to enumerate the administrative password hash has been published.

The vulnerabilities have been reported in versions 5.x, 6.x and possibly 7.x.

Solution:
Edit the source to ensure that input is properly verified.

Use another product.

Provided and/or discovered by:
pokleyzz

Original Advisory:
http://www.scan-associates.net/papers/phpnuke69.txt

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News