Sql injection bugs in PHP-Nuke
Hi,
These bugs were published in full-disclosure about 2 weeks ago (CVE-2007-0372).
There are 5 sql injections in PHP-Nuke 7.9 (and maybe other versions including
version 8) :
Three of them exist in 'advertising', 'weblinks' and 'reviews' sections, which
can be dangerous and are not discribed here .
Two others are in admin section :
The 'active' parameter has been passed to "module_status()" function without
proper checking :
File /admin/modules/modules.php, Line 281 :
** module_status($mid, $active);
And in "module_status()" function :
File /admin/modules/modules.php, Line 173 :
** $db->sql_query("update " . $prefix . "_modules set
active='$active' where mid='$mid'");
Also the 'ad_class', 'imageurl', 'clickurl', 'ad_code' and 'position' parameters
are not checked properly :
File modules/Advertising/admin/index.php, Line 1131 :
** BannersAdd($name, $cid, $adname, $imptotal, $imageurl,
$clickurl, $alttext, $position, $active, $ad_class, $ad_code, $ad_width,
$ad_height);
And in "BannersAdd()" function :
File modules/Advertising/admin/index.php, Line 351 :
** $db->sql_query("insert into " . $prefix . "_banner values
(NULL, '$cid', '$adname', '$imptotal', '1', '0', '$imageurl', '$clickurl',
'$alttext', now(), '00-00-0000 00:00:00', '$position', '$active', '$ad_class',
'$ad_code', '$ad_width', '$ad_height')");
The author told me he will fix the bugs for the next version (8.1) .
The original advisory (in Persian) is located at :
http://www.hackers.ir/advisories/festival.txt
- Omid