Release Date: 2004-02-10
Critical: Moderately critical
Impact: Cross Site Scripting, Manipulation of data, Exposure of system information
Exposure of sensitive information
Where: From remote
Software: PHP-Nuke 6.x, PHP-Nuke 7.x
Description:
Janek Vind has reported three vulnerabilities in PHP-Nuke, allowing malicious people to conduct Cross Site Scripting and SQL injection attacks.
1) The "title" and "fname" parameters aren't handled properly in "/modules/News/friend.php", which can be exploited to include arbitrary script code and HTML.
This vulnerability has been reported in version 7.10.
2) In the "Reviews" and "News" modules, it is possible to include script code in the "title" parameter by hex encoding certain characters.
This vulnerability has been reported in version 7.10.
3) The "p_msg" parameter in "mainfile.php" is base64 decoded before it is used in a SQL query, which effectively bypasses magic_quotes_gpc. This can be exploited to include malicious characters, making it possible to manipulate and inject SQL queries.
A sample exploit has been released, which can extract the administrative password exploiting issue 3 if the underlying database is MySQL 4.
This vulnerability has been reported in version 6 releases and version 7.10.
Solution:
Edit the source to ensure that input is properly handled and filtered.
Provided and/or discovered by:
Janek Vind
Source: Secunia