Multiple PHPNuke SQL Injection And Cross-Site Scripting Vulnerabilities
BID:10741
Info
Multiple PHPNuke SQL Injection And Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 10741 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 16 2004 12:00AM |
| Updated: | Jul 16 2004 12:00AM |
| Credit: | Janek Vind <[email protected]> disclosed these vulnerabilities. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 7.3 |
| Not Vulnerable: | |
Discussion
Multiple PHPNuke SQL Injection And Cross-Site Scripting Vulnerabilities
It is reported that PHPNuke is susceptible to a cross-site scripting vulnerability and an SQL injection vulnerability.
Both of these vulnerabilities are due to improper sanitization of user-supplied data.
Attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. This may result in unauthorized operations being performed on the underlying database. This issue may be exploited to cause sensitive information to be disclosed to a remote attacker.
The cross-site scripting vulnerability is reported to exist in the same script. As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.
This may allow for theft of cookie-based authentication credentials and other attacks.
These vulnerabilities were reported in version 7.3 of PHPNuke. Other versions may also be affected.
It is reported that PHPNuke is susceptible to a cross-site scripting vulnerability and an SQL injection vulnerability.
Both of these vulnerabilities are due to improper sanitization of user-supplied data.
Attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. This may result in unauthorized operations being performed on the underlying database. This issue may be exploited to cause sensitive information to be disclosed to a remote attacker.
The cross-site scripting vulnerability is reported to exist in the same script. As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.
This may allow for theft of cookie-based authentication credentials and other attacks.
These vulnerabilities were reported in version 7.3 of PHPNuke. Other versions may also be affected.
Exploit / POC
Multiple PHPNuke SQL Injection And Cross-Site Scripting Vulnerabilities
No exploit is required.
An example of a search request sufficient to trigger the cross-site scripting vulnerability:
1"><body onload="alert(document.cookie);
An example of the SQL injection vulnerability:
http://www.example.com/nuke73/modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/0,0,pwd,0,aid/**/FROM/**/nuke_authors
No exploit is required.
An example of a search request sufficient to trigger the cross-site scripting vulnerability:
1"><body onload="alert(document.cookie);
An example of the SQL injection vulnerability:
http://www.example.com/nuke73/modules.php?name=Search&type=comments&query=not123exists&instory=/**/UNION/**/SELECT/**/0,0,pwd,0,aid/**/FROM/**/nuke_authors
Solution / Fix
Multiple PHPNuke SQL Injection And Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Multiple PHPNuke SQL Injection And Cross-Site Scripting Vulnerabilities
References:
References:
- PHPNuke INP Homepage (PHPNuke INP)
- [waraxe-2004-SA#035 - Multiple security holes in PhpNuke - part 2] (Janek Vind