<<< Date Index >>>     <<< Thread Index >>>

Sql injection bugs in PHP-Nuke



Hi,

These bugs were published in full-disclosure about 2 weeks ago (CVE-2007-0372).

There are 5 sql injections in PHP-Nuke 7.9 (and maybe other versions including
version 8) :

Three of them exist in 'advertising', 'weblinks' and 'reviews' sections, which
can be dangerous and are not discribed here .
Two others are in admin section :

The 'active' parameter has been passed to "module_status()" function without
proper checking :

File /admin/modules/modules.php, Line 281 :
**              module_status($mid, $active);

And in "module_status()" function :

File /admin/modules/modules.php, Line 173 :
**              $db->sql_query("update " . $prefix . "_modules set 
active='$active' where mid='$mid'");


Also the 'ad_class', 'imageurl', 'clickurl', 'ad_code' and 'position' parameters
are not checked properly :

File modules/Advertising/admin/index.php, Line 1131 :
**              BannersAdd($name, $cid, $adname, $imptotal, $imageurl, 
$clickurl, $alttext, $position, $active, $ad_class, $ad_code, $ad_width, 
$ad_height);

And in "BannersAdd()" function :

File modules/Advertising/admin/index.php, Line 351 :
**              $db->sql_query("insert into " . $prefix . "_banner values 
(NULL, '$cid', '$adname', '$imptotal', '1', '0', '$imageurl', '$clickurl', 
'$alttext', now(), '00-00-0000 00:00:00', '$position', '$active', '$ad_class', 
'$ad_code', '$ad_width', '$ad_height')");

The author told me he will fix the bugs for the next version (8.1) .

The original advisory (in Persian) is located at :
http://www.hackers.ir/advisories/festival.txt


- Omid