PHP Nuke Remote SQL Query Manipulation Vulnerability
BID:3114
Info
PHP Nuke Remote SQL Query Manipulation Vulnerability
| Bugtraq ID: | 3114 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2001 12:00AM |
| Updated: | Jul 28 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on July 28th, 2001 by "David Page" <[email protected]>. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 5.0.1 Francisco Burzi PHP-Nuke 5.0 Francisco Burzi PHP-Nuke 4.4.1 a Francisco Burzi PHP-Nuke 4.4 Francisco Burzi PHP-Nuke 4.3 Francisco Burzi PHP-Nuke 4.0 Francisco Burzi PHP-Nuke 3.0 Francisco Burzi PHP-Nuke 2.5 Francisco Burzi PHP-Nuke 1.0 |
| Not Vulnerable: | |
Discussion
PHP Nuke Remote SQL Query Manipulation Vulnerability
PHP-Nuke is a website creation/maintenance tool written in PHP3.
Many of the scripts in PHP-Nuke fail to properly validate user-supplied input. This can permit an attacker to corrupt SQL queries that include unfiltered user-supplied variables.
This vulnerability is known to exist in the 'reviews.php' script.
NOTE: This problem is associated with PHP 3, as PHP 4 has features in places to filter malicious content from requests.
PHP-Nuke is a website creation/maintenance tool written in PHP3.
Many of the scripts in PHP-Nuke fail to properly validate user-supplied input. This can permit an attacker to corrupt SQL queries that include unfiltered user-supplied variables.
This vulnerability is known to exist in the 'reviews.php' script.
NOTE: This problem is associated with PHP 3, as PHP 4 has features in places to filter malicious content from requests.
Solution / Fix
PHP Nuke Remote SQL Query Manipulation Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.