ID
VAR-200604-0373
CVE
CVE-2006-1846
TITLE
PHP-Nuke Your_Account Module Cross-site scripting vulnerability
Trust: 0.6
DESCRIPTION
Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, it is unclear whether this issue is a vulnerability, since it is related to the user's personal menu, which presumably is not modifiable by others. PHPNuke is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The application is prone to HTML- and SQL-injection vulnerabilities. PHPNuke 7.8 is reported to be vulnerable. Other versions may also be affected. The Your_Account module in PHP-Nuke 7.8 has a cross-site scripting vulnerability. TITLE: PHP-Nuke Personal Menu Script Insertion and SQL Injection SECUNIA ADVISORY ID: SA18972 VERIFY ADVISORY: http://secunia.com/advisories/18972/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: >From remote SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/ DESCRIPTION: Jason Lau has discovered two vulnerabilities in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection and script insertion attacks. Example: <img src=javascript:[code]> (requires the Microsoft Internet Explorer browser) 2) Input passed to the "user_id" parameter in the "Your_Home" functionality of the "Your_Account" module isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation requires that "magic_quotes_gpc" is disabled. The vulnerabilities have been confirmed in version 7.8. SOLUTION: Edit the source code to ensure that input is properly sanitised. PROVIDED AND/OR DISCOVERED BY: Jason Lau ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------
Trust: 1.35
AFFECTED PRODUCTS
| vendor: | francisco burzi | model: | php-nuke | scope: | eq | version: | 7.8 | Trust: 1.6 |
| vendor: | francisco | model: | burzi php-nuke | scope: | eq | version: | 7.8 | Trust: 0.3 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | NVD-CWE-Other | Trust: 1.0 |
THREAT TYPE
remote
Trust: 0.6
TYPE
XSS
Trust: 0.6
EXTERNAL IDS
| db: | BID | id: | 16774 | Trust: 2.0 |
| db: | SECUNIA | id: | 18972 | Trust: 1.8 |
| db: | NVD | id: | CVE-2006-1846 | Trust: 1.7 |
| db: | OSVDB | id: | 23431 | Trust: 1.7 |
| db: | VUPEN | id: | ADV-2006-0687 | Trust: 1.7 |
| db: | CNNVD | id: | CNNVD-200604-291 | Trust: 0.7 |
| db: | VULHUB | id: | VHN-17954 | Trust: 0.1 |
| db: | PACKETSTORM | id: | 44052 | Trust: 0.1 |
REFERENCES
| url: | http://www.securityfocus.com/bid/16774 | Trust: 1.7 |
| url: | http://www.osvdb.org/23431 | Trust: 1.7 |
| url: | http://secunia.com/advisories/18972 | Trust: 1.7 |
| url: | http://www.vupen.com/english/advisories/2006/0687 | Trust: 1.1 |
| url: | http://www.frsirt.com/english/advisories/2006/0687 | Trust: 0.6 |
| url: | http://www.phpnuke.org | Trust: 0.3 |
| url: | http://secunia.com/secunia_security_advisories/ | Trust: 0.1 |
| url: | http://secunia.com/product/2385/ | Trust: 0.1 |
| url: | http://secunia.com/advisories/18972/ | Trust: 0.1 |
| url: | http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org | Trust: 0.1 |
| url: | http://secunia.com/about_secunia_advisories/ | Trust: 0.1 |
CREDITS
Discovered by Jason Lau.
Trust: 0.9
SOURCES
| db: | VULHUB | id: | VHN-17954 |
| db: | BID | id: | 16774 |
| db: | PACKETSTORM | id: | 44052 |
| db: | CNNVD | id: | CNNVD-200604-291 |
| db: | NVD | id: | CVE-2006-1846 |
LAST UPDATE DATE
2024-08-14T13:39:45.815000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-17954 | date: | 2011-03-08T00:00:00 |
| db: | BID | id: | 16774 | date: | 2006-02-23T18:57:00 |
| db: | CNNVD | id: | CNNVD-200604-291 | date: | 2006-04-20T00:00:00 |
| db: | NVD | id: | CVE-2006-1846 | date: | 2011-03-08T02:34:24.487 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-17954 | date: | 2006-04-19T00:00:00 |
| db: | BID | id: | 16774 | date: | 2005-11-08T00:00:00 |
| db: | PACKETSTORM | id: | 44052 | date: | 2006-02-22T19:02:22 |
| db: | CNNVD | id: | CNNVD-200604-291 | date: | 2006-04-19T00:00:00 |
| db: | NVD | id: | CVE-2006-1846 | date: | 2006-04-19T16:06:00 |