From: "Omid" <omid@hackers.ir.>
To: <bugtraq@securityfocus.com.>
Subject: Sql injection bugs in PHP-Nuke
Date: Sun, 04 Feb 2007 20:35:37 +0330
User-Agent: Hackers.ir/1.0
MIME-Version: 1.0
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: 8bit
Importance: Normal
X-Priority: 3 (Normal)
X-Mailer: Hackers.ir/1.0
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hi,
These bugs were published in full-disclosure about 2 weeks ago (CVE-2007-0372).
There are 5 sql injections in PHP-Nuke 7.9 (and maybe other versions including
version 8) :
Three of them exist in 'advertising', 'weblinks' and 'reviews' sections, which
can be dangerous and are not discribed here .
Two others are in admin section :
The 'active' parameter has been passed to "module_status()" function without
proper checking :
File /admin/modules/modules.php, Line 281 :
module_status($mid, $active);
And in "module_status()" function :
File /admin/modules/modules.php, Line 173 :
$db->sql_query("update " . $prefix . "_modules set active='$active' where mid='$mid'");
Also the 'ad_class', 'imageurl', 'clickurl', 'ad_code' and 'position' parameters
are not checked properly :
File modules/Advertising/admin/index.php, Line 1131 :
BannersAdd($name, $cid, $adname, $imptotal, $imageurl, $clickurl, $alttext, $position, $active, $ad_class, $ad_code, $ad_width, $ad_height);
And in "BannersAdd()" function :
File modules/Advertising/admin/index.php, Line 351 :
$db->sql_query("insert into " . $prefix . "_banner values (NULL, '$cid', '$adname', '$imptotal', '1', '0', '$imageurl', '$clickurl', '$alttext', now(), '00-00-0000 00:00:00', '$position', '$active', '$ad_class', '$ad_code', '$ad_width', '$ad_height')");
The author told me he will fix the bugs for the next version (8.1) .
The original advisory (in Persian) is located at :
http://www.hackers.ir/advisories/festival.txt
- Omid
