PostNuke contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the "sif" variable in the "modules/NS-Comments/index.php" module is not verified properly and will allow an attacker to inject or manipulate SQL queries.

PostNuke has released a patch to address this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Modify the source code such that the $sid and $pid variables in modules/NS-Comments/index.php line 1142 are properly verified:

VALUES ($nextid,
'".pnVarPrepForStore($pid)."',
'".pnVarPrepForStore($sid)."',
now(),
'".pnVarPrepForStore($uname)."',
'".pnVarPrepForStore($email)."',
'".pnVarPrepForStore($url)."',
'".pnVarPrepForStore($ip)."',
'".pnVarPrepForStore($subject)."',
'".pnVarPrepForStore($comment)."',
'".pnVarPrepForStore($score)."',
0)");

• Keyword: 0.723 0.726-1 1009801 10146 SA11386
• Security Tracker: 1009801
• Bugtraq ID: 10146
• Secunia Advisory ID: 11386
• ISS X-Force ID: 15869 15875
• CVE ID: 2004-1949 (see also: NVD)
• Related OSVDB ID: 5369
• Vendor Specific Solution URL: http://downloads.postnuke.com/pafiledb.php?action=category&id=46
• Mail List Post: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html
  http://marc.theaimsgroup.com/?l=bugtraq&m=108256503718978&w=2
• Other Advisory URL: http://marc.theaimsgroup.com/?l=full-disclosure&m=108200489515143&w=2
• Vendor Specific News/Changelog Entry: http://news.postnuke.com/Article2580.html
• Vendor Specific Advisory URL: http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2580&mode=thread&order=0&thold=0
• Generic Exploit URL: http://www.scan-associates.net/papers/post_nuker.php.txt

• pokleyzz - pokleyzzscan-associates.net - SCAN Associates Sdn. Bhd.