Info

Disclosure

Apr 14, 2004

Discovery

Unknown

Dates

Exploit

Apr 14, 2004

Solution

Unknown

Description

PostNuke contains a flaw that will allow an attacker to inject arbitrary SQL code. The problem is that the "sif" variable in the "modules/NS-Comments/index.php" module is not verified properly and will allow an attacker to inject or manipulate SQL queries.

Classification

Location: Remote / Network Access
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified
OSVDB: Web Related

Solution

PostNuke has released a patch to address this vulnerability. It is also possible to correct the flaw by implementing the following workaround: Modify the source code such that the $sid and $pid variables in modules/NS-Comments/index.php line 1142 are properly verified: VALUES ($nextid, '".pnVarPrepForStore($pid)."', '".pnVarPrepForStore($sid)."', now(), '".pnVarPrepForStore($uname)."', '".pnVarPrepForStore($email)."', '".pnVarPrepForStore($url)."', '".pnVarPrepForStore($ip)."', '".pnVarPrepForStore($subject)."', '".pnVarPrepForStore($comment)."', '".pnVarPrepForStore($score)."', 0)");

Products

PostNuke	PostNuke	0.723
		0.726
		0.726-1

References

Keyword: 0.723 0.726-1 1009801 10146 SA11386
Security Tracker: 1009801
Bugtraq ID: 10146
Secunia Advisory ID: 11386
ISS X-Force ID: 15869 15875
CVE ID: 2004-1949 (see also: NVD)
Related OSVDB ID: 5369
Vendor Specific Solution URL: http://downloads.postnuke.com/pafiledb.php?action=category&id=46
Mail List Post: http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020154.html
http://marc.theaimsgroup.com/?l=bugtraq&m=108256503718978&w=2
Other Advisory URL: http://marc.theaimsgroup.com/?l=full-disclosure&m=108200489515143&w=2
Vendor Specific News/Changelog Entry: http://news.postnuke.com/Article2580.html
Vendor Specific Advisory URL: http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2580&mode=thread&order=0&thold=0
Generic Exploit URL: http://www.scan-associates.net/papers/post_nuker.php.txt

Credit

pokleyzz - pokleyzzscan-associates.net - SCAN Associates Sdn. Bhd.

Direct URL: http://osvdb.org/5368