ID

VAR-200604-0374

CVE

CVE-2006-1847

TITLE

PHP-Nuke Your_Account Module SQL Injection vulnerability

DESCRIPTION

SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. PHPNuke is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The application is prone to HTML- and SQL-injection vulnerabilities. PHPNuke 7.8 is reported to be vulnerable. Other versions may also be affected. TITLE: PHP-Nuke Personal Menu Script Insertion and SQL Injection SECUNIA ADVISORY ID: SA18972 VERIFY ADVISORY: http://secunia.com/advisories/18972/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: >From remote SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/ DESCRIPTION: Jason Lau has discovered two vulnerabilities in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection and script insertion attacks. 1) Input passed to the "ublock" parameter in the "Your_Home" functionality of the "Your_Account" module isn't properly sanitised before being saved as the user's personal menu. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site when the user views his personal menu. Example: <img src=javascript:[code]> (requires the Microsoft Internet Explorer browser) 2) Input passed to the "user_id" parameter in the "Your_Home" functionality of the "Your_Account" module isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This can be further exploited with vulnerability #1 to inject arbitrary HTML and script code into arbitrary user's personal menu. Successful exploitation requires that "magic_quotes_gpc" is disabled. The vulnerabilities have been confirmed in version 7.8. SOLUTION: Edit the source code to ensure that input is properly sanitised. PROVIDED AND/OR DISCOVERED BY: Jason Lau ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

sql injection

EXTERNAL IDS

REFERENCES

CREDITS

Discovered by Jason Lau.

SOURCES

LAST UPDATE DATE

2024-08-14T13:39:45.785000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE