PostNuke PNPHPBB2 Module Index.PHP SQL Injection Vulnerability

Bugtraq ID:	24295
Class:	Input Validation Error
CVE:	CVE-2007-3052
Remote:	Yes
Local:	No
Published:	Jun 04 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Kacper is credited with the discovery of this vulnerability.
Vulnerable:	PNphpBB PNphpBB 1.2 g PNphpBB PNphpBB 1.2 f PNphpBB PNphpBB 1.2
Not Vulnerable:

PostNuke PNPHPBB2 Module Index.PHP SQL Injection Vulnerability

The PostNuke PNPHPBB2 module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

This issue affects PNPHPBB2 1.2; prior versions are also affected.

PostNuke PNPHPBB2 Module Index.PHP SQL Injection Vulnerability

Attackers can use a browser to exploit this issue.

The following exploit code is available:

• /data/vulnerabilities/exploits/24295.pl

PostNuke PNPHPBB2 Module Index.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PostNuke PNPHPBB2 Module Index.PHP SQL Injection Vulnerability

References:

• PNphpBB Homepage (PNphpBB)