Sign-up

ID

VAR-200602-0274


CVE

CVE-2006-0679


TITLE

PHP-Nuke Your_Account Module remote SQL Injection vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200602-245

DESCRIPTION

SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field). PHPNuke is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. PHP-Nuke is a popular website creation and management tool, it can use many database software as backend, such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. There is an input validation vulnerability in the implementation of Your_Account module of PHP-Nuke. The Your_Account module of PHP-Nuke does not fully filter and check the username parameter. A remote attacker may insert malicious SQL commands into this parameter, thereby obtaining unauthorized operations on the background database. TITLE: PHP-Nuke "Your_Account" Module SQL Injection Vulnerability SECUNIA ADVISORY ID: SA18931 VERIFY ADVISORY: http://secunia.com/advisories/18931/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: >From remote SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/ PHP-Nuke 6.x http://secunia.com/product/329/ DESCRIPTION: sp3x has discovered a vulnerability in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection attacks. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability has been confirmed in version 7.8. Other versions may also be affected. SOLUTION: The vulnerability has reportedly been fixed in version 7.9 with patch 3.1. PROVIDED AND/OR DISCOVERED BY: sp3x ORIGINAL ADVISORY: http://securityreason.com/securityalert/440 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.35

sources: NVD: CVE-2006-0679 // BID: 16691 // VULHUB: VHN-16787 // PACKETSTORM: 43953

AFFECTED PRODUCTS

vendor:francisco burzimodel:php-nuke evscope:eqversion:7.8

Trust: 1.6

vendor:php nukemodel:php-nukescope:eqversion:7.7

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.6

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.5

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.4

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.3

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.2

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.1

Trust: 0.3

vendor:php nukemodel:php-nukescope:eqversion:7.0

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.8

Trust: 0.3

vendor:php nukemodel:php-nukescope:neversion:7.9

Trust: 0.3

sources: BID: 16691 // CNNVD: CNNVD-200602-245 // NVD: CVE-2006-0679

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-0679
value: HIGH

Trust: 1.0

CNNVD: CNNVD-200602-245
value: HIGH

Trust: 0.6

VULHUB: VHN-16787
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2006-0679
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-16787
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-16787 // CNNVD: CNNVD-200602-245 // NVD: CVE-2006-0679

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-0679

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200602-245

TYPE

sql injection

Trust: 0.7

sources: PACKETSTORM: 43953 // CNNVD: CNNVD-200602-245

EXTERNAL IDS

db:NVDid:CVE-2006-0679

Trust: 2.0

db:BIDid:16691

Trust: 2.0

db:SECUNIAid:18931

Trust: 1.9

db:SREASONid:440

Trust: 1.8

db:OSVDBid:23259

Trust: 1.7

db:VUPENid:ADV-2006-0636

Trust: 1.7

db:CNNVDid:CNNVD-200602-245

Trust: 0.7

db:XFid:24769

Trust: 0.6

db:FULLDISCid:20060216 CRITICAL SQL INJECTION PHPNUKE <= 7.8 - YOUR_ACCOUNT MODULE

Trust: 0.6

db:BUGTRAQid:20060216 CRITICAL SQL INJECTION PHPNUKE <= 7.8 - YOUR_ACCOUNT MODULE

Trust: 0.6

db:SREASONRESid:20060216 CRITICAL SQL INJECTION PHPNUKE <= 7.8 - YOUR_ACCOUNT MODULE

Trust: 0.6

db:VULHUBid:VHN-16787

Trust: 0.1

db:PACKETSTORMid:43953

Trust: 0.1

sources: VULHUB: VHN-16787 // BID: 16691 // PACKETSTORM: 43953 // CNNVD: CNNVD-200602-245 // NVD: CVE-2006-0679

REFERENCES

url:http://securityreason.com/securityalert/440

Trust: 1.8

url:http://www.securityfocus.com/bid/16691

Trust: 1.7

url:http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0358.html

Trust: 1.7

url:http://www.osvdb.org/23259

Trust: 1.7

url:http://secunia.com/advisories/18931

Trust: 1.7

url:http://securityreason.com/achievement_securityalert/32

Trust: 1.7

url:http://www.securityfocus.com/archive/1/425173/100/0/threaded

Trust: 1.1

url:http://www.vupen.com/english/advisories/2006/0636

Trust: 1.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/24769

Trust: 1.1

url:http://xforce.iss.net/xforce/xfdb/24769

Trust: 0.6

url:http://www.securityfocus.com/archive/1/archive/1/425173/100/0/threaded

Trust: 0.6

url:http://www.frsirt.com/english/advisories/2006/0636

Trust: 0.6

url:http://www.ncc.org.ve/php-nuke.php3?op=english

Trust: 0.3

url:http://www.irannuke.com/

Trust: 0.3

url:http://securityreason.com/achievement_exploitalert/7

Trust: 0.3

url:/archive/1/425173

Trust: 0.3

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/product/329/

Trust: 0.1

url:http://secunia.com/advisories/18931/

Trust: 0.1

url:http://secunia.com/product/2385/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: VULHUB: VHN-16787 // BID: 16691 // PACKETSTORM: 43953 // CNNVD: CNNVD-200602-245 // NVD: CVE-2006-0679

CREDITS

sp3x sp3 @ xsecurityreason.com)

Trust: 0.6

sources: CNNVD: CNNVD-200602-245

SOURCES

db:VULHUBid:VHN-16787
db:BIDid:16691
db:PACKETSTORMid:43953
db:CNNVDid:CNNVD-200602-245
db:NVDid:CVE-2006-0679

LAST UPDATE DATE

2024-11-23T22:15:21.595000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-16787date:2018-10-19T00:00:00
db:BIDid:16691date:2006-02-17T02:42:00
db:CNNVDid:CNNVD-200602-245date:2006-02-17T00:00:00
db:NVDid:CVE-2006-0679date:2024-11-21T00:07:04.737

SOURCES RELEASE DATE

db:VULHUBid:VHN-16787date:2006-02-16T00:00:00
db:BIDid:16691date:2006-02-16T00:00:00
db:PACKETSTORMid:43953date:2006-02-17T23:46:33
db:CNNVDid:CNNVD-200602-245date:2006-02-16T00:00:00
db:NVDid:CVE-2006-0679date:2006-02-16T20:06:00