OpenPHPnuke SQLite Abstraction Layer SQL Injection Vulnerability
BID:34088
Info
OpenPHPnuke SQLite Abstraction Layer SQL Injection Vulnerability
| Bugtraq ID: | 34088 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 11 2009 12:00AM |
| Updated: | Mar 12 2009 07:46PM |
| Credit: | Reported by the vendor |
| Vulnerable: |
OpenPHPnuke OpenPHPnuke 2.4.15 OpenPHPnuke OpenPHPnuke 2.3.5 OpenPHPnuke OpenPHPnuke 2.3.3 |
| Not Vulnerable: |
OpenPHPnuke OpenPHPnuke 2.4.16 |
Discussion
OpenPHPnuke SQLite Abstraction Layer SQL Injection Vulnerability
OpenPHPnuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to OpenPHPnuke 2.4.16 are vulnerable.
OpenPHPnuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to OpenPHPnuke 2.4.16 are vulnerable.
Exploit / POC
OpenPHPnuke SQLite Abstraction Layer SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
OpenPHPnuke SQLite Abstraction Layer SQL Injection Vulnerability
Solution:
The vendor has released an update. Please see the references for more information.
Solution:
The vendor has released an update. Please see the references for more information.
References
OpenPHPnuke SQLite Abstraction Layer SQL Injection Vulnerability
References:
References:
- OpenPHPNuke Changelog (OpenPHPNuke)
- OpenPHPnuke Homepage (OpenPHPnuke)