PHP-Nuke 'Submit_News' Component SQL Injection Vulnerability

Bugtraq ID:	67656
Class:	Input Validation Error
CVE:	CVE-2014-3934
Remote:	Yes
Local:	No
Published:	May 24 2014 12:00AM
Updated:	Jun 09 2014 12:12AM
Credit:	ali ahmady
Vulnerable:
Not Vulnerable:

PHP-Nuke 'Submit_News' Component SQL Injection Vulnerability

PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP-Nuke 8.3 is vulnerable; other versions may also be affected.

PHP-Nuke 'Submit_News' Component SQL Injection Vulnerability

An attacker can exploit this issue using a browser.

The following example URI is available:

http://www.example.com/modules.php?name=Submit_News&subject=whatever&topics[]=[SQLi]

PHP-Nuke 'Submit_News' Component SQL Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

PHP-Nuke 'Submit_News' Component SQL Injection Vulnerability

References:

• PHP-Nuke Homepage (PHP-Nuke)