That looks a lot like a *nuke (PHPNuke & forks like PostNuke).

The "thold" param has a history of issues, XSS and the like, and
I seem to recall it is handled by the "Sections" module in Nuke.

If it's the code I think it is, there are more issues with other
params which are even listed in the example below.

(Hint: the op param)

Cheers,

Arian J. Evans
FishNet Security
913.710.7085 [mobile]
816.701.2045 [office]


=20


=20

> -----Original Message-----
> From: security curmudgeon [mailto:jericho@attrition.org]=20
> Sent: Sunday, May 21, 2006 8:43 PM
> To: Mster-X@hotmail.com
> Cc: bugtraq@securityfocus.com
> Subject: Re: modules name(Sections)SQL Injection Exploit
>=20
>=20
> : ********************
> : By: Mr-X
> : Email: Mster-X@hotmail.com
> : Subject: modules name(Sections)SQL Injection=20
> : ********************
> :=20
> : example:-
> :=20
> =
/modules.php?name=3DSurveys&op=3Dresults&pollID=3D8 &mode=3D&order=3D&thol=
d=3D[SQL]
>=20
> What product is this in? Searching for "modules name=20
> sections" is not that=20
> helpful.
>=20