PHP-Nuke All Version

vendor:

PHP-Nuke

by:

ItSecTeam

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHP-Nuke

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

This Bug Works when Register_Globals=On. A SQL Injection vulnerability exists in the ratedownload() function of modules.php in PHP-Nuke. The vulnerability is due to the lack of input validation of the 'lid' parameter when passed to the ratedownload() function. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Mitigation:

Input validation should be performed to ensure that user-supplied data is not used to construct SQL queries.

Source

Exploit-DB raw data:

===========================================================================
( #Topic    : PHP-Nuke All Version
( #Bug type : SQL Injection
( #Download : http://phpnuke.org/modules.php?name=Downloads
( #Advisory : http://itsecteam.com/fa/vulnerabilities/vulnerability21.htm
===========================================================================
( #Author : ItSecTeam
( #Email  : Bug@ITSecTeam.com #
( #Website: http://www.itsecteam.com #
( #Forum  : http://forum.ITSecTeam.com #
( #Thanks : Amin Shokohi(Pejvak!) , M3hr@n.S , 0xd41684c654 And All Team

Exploit ===================================================================
( *
http://[site]/PHP-Nuke/modules.php?view=0&name=downloads&file=index&d_op=ratedownload&lid=
SQL Injection Code
---------------------------------------------------------------------------
<BUG>
  function ratedownload($lid, $user) {
    global $prefix, $cookie, $datetime, $module_name, $user_prefix;
    include("header.php");
    menu(1);
    $row = $db->sql_fetchrow($db->sql_query("SELECT title FROM
".$prefix."_downloads_downloads WHERE lid='**BUG**$lid'**BUG**"));
........}
</Bug>
----------------------------------------------------------------------------
This Bug Works when Register_Globals=On
============================================================================