Onderwerp: PHP-Nuke SQL Injection

Version: PHP-Nuke 6.6
Language: PHP
Web site: phpnuke.org
Status: Vendor has been notified

There's an SQL injection hole in modules.php.

http://phpnuke.org/modules.php?name=...9%20or%20cid=2

This is from not filtering 'cid', it should be checked that it is only numeric with is_numeric(). This hole could allow viewing of password hashes if the database is mysql 4.x.

This may effect other versions.

Dear mod,

This SQL injection bug and another one (in web-link) in Spaiz-Nuke and
PHP-nuke was reported few days ago by 1dt.w0lf (idtwolf_at_sigaret.net)
(sorry, in Russian, but you can see exploitation examples):
http://www.security.nnov.ru/search/d...asp?docid=5201

--Wednesday, October 8, 2003, 7:37:38 PM, you wrote to bugtraq@securityfocus.com:



m> Version: PHP-Nuke 6.6
m> Language: PHP
m> Web site: phpnuke.org
m> Status: Vendor has been notified

m> There's an SQL injection hole in modules.php.

m> http://phpnuke.org/modules.php?name=...9%20or%20cid=2

--
~/ZARAZA
Но Гарри... я безусловно отдаю предпочтение ему, за
высокую питательность и какое-то особенно нежное мясо. (Твен)