PHPNuke Web_Links Module Remote SQL Injection Vulnerability
BID:7558
Info
PHPNuke Web_Links Module Remote SQL Injection Vulnerability
| Bugtraq ID: | 7558 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2003 12:00AM |
| Updated: | May 12 2003 12:00AM |
| Credit: | Discovery credited to Albert Puigsech Galicia <[email protected]>. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 6.9 Francisco Burzi PHP-Nuke 6.7 Francisco Burzi PHP-Nuke 6.6 Francisco Burzi PHP-Nuke 6.5 RC3 Francisco Burzi PHP-Nuke 6.5 RC2 Francisco Burzi PHP-Nuke 6.5 RC1 Francisco Burzi PHP-Nuke 6.5 FINAL Francisco Burzi PHP-Nuke 6.5 BETA 1 Francisco Burzi PHP-Nuke 6.5 Francisco Burzi PHP-Nuke 6.0 Francisco Burzi PHP-Nuke 5.6 Francisco Burzi PHP-Nuke 5.5 Francisco Burzi PHP-Nuke 5.4 Francisco Burzi PHP-Nuke 5.3.1 Francisco Burzi PHP-Nuke 5.2 a Francisco Burzi PHP-Nuke 5.2 Francisco Burzi PHP-Nuke 5.1 Francisco Burzi PHP-Nuke 5.0.1 Francisco Burzi PHP-Nuke 5.0 |
| Not Vulnerable: | |
Discussion
PHPNuke Web_Links Module Remote SQL Injection Vulnerability
It has been reported that multiple input validation bugs exist in the Web_Links module used by PHPNuke. Because of this, a remote user may be able to access the database and potentially gain access to sensitive information. Successful exploitation could result in compromise of the web forums or more severe consequences.
It has been reported that multiple input validation bugs exist in the Web_Links module used by PHPNuke. Because of this, a remote user may be able to access the database and potentially gain access to sensitive information. Successful exploitation could result in compromise of the web forums or more severe consequences.
Exploit / POC
PHPNuke Web_Links Module Remote SQL Injection Vulnerability
The following proof of concept was made available by Albert Puigsech Galicia <[email protected]>:
http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=2%20<our_code>
where <our_code> represents attacker-supplied SQL code.
The following proof of concept was made available by Albert Puigsech Galicia <[email protected]>:
http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=2%20<our_code>
where <our_code> represents attacker-supplied SQL code.
Solution / Fix
PHPNuke Web_Links Module Remote SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHPNuke Web_Links Module Remote SQL Injection Vulnerability
References:
References:
- Lot of SQL injection on PHP-Nuke 6.5 (secure weblog!) (Albert Puigsech Galicia
- PHPNuke 6.9 > and below SQL Injection in multiple module (pokley