myPHPNuke auth.inc.php SQL Injection Vulnerability
BID:8663
Info
myPHPNuke auth.inc.php SQL Injection Vulnerability
| Bugtraq ID: | 8663 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 20 2003 12:00AM |
| Updated: | Sep 20 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Lifo Fifo <[email protected]> and hackingzone.org. |
| Vulnerable: |
myPHPNuke myPHPNuke 1.8.8 |
| Not Vulnerable: | |
Discussion
myPHPNuke auth.inc.php SQL Injection Vulnerability
It has been reported that myPHPNuke is prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The issue may exist in the auth.in.php module of the software.
The cause of this problem is due to insufficient sanitization of user-supplied data. An attacker may be able to exploit this issue to influence SQL query logic. Successful exploitation may disclose sensitive information about the underlying database to an attacker, which may be used to launch further attacks against a vulnerable system.
myPHPNuke version 1.8.8 has been reported to be prone to this issue, however other versions may be affected as well.
It has been reported that myPHPNuke is prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The issue may exist in the auth.in.php module of the software.
The cause of this problem is due to insufficient sanitization of user-supplied data. An attacker may be able to exploit this issue to influence SQL query logic. Successful exploitation may disclose sensitive information about the underlying database to an attacker, which may be used to launch further attacks against a vulnerable system.
myPHPNuke version 1.8.8 has been reported to be prone to this issue, however other versions may be affected as well.
Exploit / POC
myPHPNuke auth.inc.php SQL Injection Vulnerability
The following proof of concept was provided:
select pwd from mpn_authors where aid='mad' into outfile '/filepath/file.txt'
The following proof of concept was provided:
select pwd from mpn_authors where aid='mad' into outfile '/filepath/file.txt'
Solution / Fix
myPHPNuke auth.inc.php SQL Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
myPHPNuke auth.inc.php SQL Injection Vulnerability
References:
References:
- myPHPNuke Homepage (myPHPNuke)
- Vulnrability in myPHPnuke 1.8.8 (Lifo Fifo