vendor:
N/A
by:
Paisterist
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
Neo Security Team – Exploit made by Paisterist
This exploit allows an attacker to gain access to the md5 hash of the first admin (God) of the nuke_authors table by sending a malicious POST request to the modules.php page.
Mitigation:
Modify the line 143 of mainfile.php, adding one more protection like: if (stripos_clone($postString,'union') OR stripos_clone($postString,'*/union/*') OR stripos_clone($postString,' union ') OR stripos_clone($postString_64,'union') OR stripos_clone($postString_64,'*/union/*') OR stripos_clone($postString_64,' union ') OR stripos_clone($postString_64,'+union+') OR stripos_clone($postString_64,' union select ')) {
