PHP-Nuke Multiple SQL Injection Vulnerabilities

Bugtraq ID:	7031
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 06 2003 12:00AM
Updated:	Mar 06 2003 12:00AM
Credit:	Discovery of these issues is credited to "Frog Man" <[email protected]>.
Vulnerable:	Francisco Burzi PHP-Nuke 6.5 BETA 1 Francisco Burzi PHP-Nuke 6.0
Not Vulnerable:

PHP-Nuke Multiple SQL Injection Vulnerabilities

Multiple SQL injection vulnerabilities were reported in the 'Members_List' and 'Your_Account' modules of PHP-Nuke. This is due to insufficient sanitization of externally supplied data which is used to construct SQL queries. A remote attacker may take advantage of these issues to inject malicious data into SQL queries, possibly resulting in modification of query logic. This may be exploited to compromise the PHP-Nuke web portal. Other attacks are also possible.

PHP-Nuke Multiple SQL Injection Vulnerabilities

There is no exploit required.

PHP-Nuke Multiple SQL Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP-Nuke Multiple SQL Injection Vulnerabilities

References:

• PHPNuke INP Homepage (PHPNuke INP)
  
• PHP-Nuke 6.0 (& 6.5?) : Serious SQL Injection Security Holes ("Frog Man" )