CVE-2008-1591: Improper Neutralization of Special Elements used in an SQL Command

The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magicquotesruntime is enabled, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via input associated with server variables, as demonstrated by the CLIENTIP...

PostNuke pnVarPrepForStore()函数SQL注入漏洞

BUGTRAQ ID: 28407 PostNuke是一款开放源码、开放开发的内容管理系统（CMS）。 PostNuke的pnVarPrepForStore函数中存在SQL盲注漏洞，远程攻击者可能利用此漏洞非授权操作数据库。 以下是有漏洞部分的代码： 1. function pnVarPrepForStore 2. 3. $resarray = array; 4. foreach funcgetargs as $ourvar 5. if !getmagicquotesruntime && !isarray$ourvar 6. $ourvar = addslashes$ourvar; 7...

PostNuke <= 0.764 Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================= PostNuke | |||| /| / / ================================================================================================= This was a priv8 Exploit...

PostNuke 0.764 - Blind SQL Injection

PostNuke 0.764 - Blind SQL Injection !/usr/bin/python ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / =================================================================================================...

PostNuke 0.764 - Blind SQL Injection

!/usr/bin/python ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ================================================================================================= This was a priv8 Exploit...