PHP-Nuke Input Validation Error in Search Module Lets Remote Users Inject SQL Commands
|
|
SecurityTracker Alert ID: 1015215
|
|
SecurityTracker URL: http://securitytracker.com/id?1015215
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 15 2005
|
Impact: Disclosure of system information, Disclosure of user information, User access via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 7.8 and prior versions
|
Description: sp3x from securityreason.com reported a vulnerability in PHP-Nuke. A remote user can inject SQL commands.
The 'Search' module does not properly validate user-supplied input in the search query field. A remote user can supply a specially
crafted parameter value to execute SQL commands on the underlying database.
Some demonstration exploit values are provided:
s%')
UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* -> users passwords and logins
s%') UNION SELECT
0,pwd,name,aid,0,0,0,0,0,0 FROM nuke_authors/* -> nuke_authors passwords and logins
A demonstration exploit is available at:
http://securityreason.com/achievement_exploitalert/5
|
Impact: A remote user can execute SQL commands on the underlying database.
|
Solution: The vendor has issued a fixed version (7.9), available at:
http://phpnuke.org/modules.php?name=Release
|
Vendor URL: www.phpnuke.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "SecurityReason - sp3x" <sp3x@securityreason.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 15 Nov 2005 15:18:44 +0100
From: "SecurityReason - sp3x" <sp3x@securityreason.com>
Subject: Critical SQL Injection PHPNuke <= 7.8
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SecurityAlert SA027
Author: sp3x
GPG: http://securityreason.com/key/sp3x.gpg
Date: 15. November 2005
Affected software :
===================
PHPNuke version : 7.8 with all security fixes/patches
Not Affected software :
=======================
PHPNuke version : 7.9 + patch 3.1
Description :
=============
PHP-Nuke is a Web Portal System, storytelling software, News system, online community or whatever you
want to call it. The goal of PHP-Nuke is to have an automated web site to distribute news and articl
es with users system. Each user can submit comments
|
|
