VAR-200604-0374

Vulnerability from variot - Updated: 2023-12-18 12:24

SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. PHPNuke is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The application is prone to HTML- and SQL-injection vulnerabilities. PHPNuke 7.8 is reported to be vulnerable. Other versions may also be affected.

TITLE: PHP-Nuke Personal Menu Script Insertion and SQL Injection

SECUNIA ADVISORY ID: SA18972

VERIFY ADVISORY: http://secunia.com/advisories/18972/

CRITICAL: Moderately critical

IMPACT: Cross Site Scripting, Manipulation of data

WHERE:

From remote

SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/

DESCRIPTION: Jason Lau has discovered two vulnerabilities in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection and script insertion attacks.

1) Input passed to the "ublock" parameter in the "Your_Home" functionality of the "Your_Account" module isn't properly sanitised before being saved as the user's personal menu. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site when the user views his personal menu.

Example: (requires the Microsoft Internet Explorer browser)

2) Input passed to the "user_id" parameter in the "Your_Home" functionality of the "Your_Account" module isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This can be further exploited with vulnerability #1 to inject arbitrary HTML and script code into arbitrary user's personal menu.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerabilities have been confirmed in version 7.8.

SOLUTION: Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY: Jason Lau

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200604-0374",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "php-nuke",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "francisco burzi",
        "version": "7.8"
      },
      {
        "model": "burzi php-nuke",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "francisco",
        "version": "7.8"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "16774"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:francisco_burzi:php-nuke:7.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Discovered by Jason Lau.",
    "sources": [
      {
        "db": "BID",
        "id": "16774"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2006-1847",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": true,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-17955",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2006-1847",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200604-293",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-17955",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. PHPNuke is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. \nThe application is prone to HTML- and SQL-injection vulnerabilities. \nPHPNuke 7.8 is reported to be vulnerable. Other versions may also be affected. \n\nTITLE:\nPHP-Nuke Personal Menu Script Insertion and SQL Injection\n\nSECUNIA ADVISORY ID:\nSA18972\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/18972/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nCross Site Scripting, Manipulation of data\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nPHP-Nuke 7.x\nhttp://secunia.com/product/2385/\n\nDESCRIPTION:\nJason Lau has discovered two vulnerabilities in PHP-Nuke, which can\nbe exploited by malicious people to conduct SQL injection and script\ninsertion attacks. \n\n1) Input passed to the \"ublock\" parameter in the \"Your_Home\"\nfunctionality of the \"Your_Account\" module isn\u0027t properly sanitised\nbefore being saved as the user\u0027s personal menu. This can be exploited\nto execute arbitrary HTML and script code in a user\u0027s browser session\nin context of an affected site when the user views his personal\nmenu. \n\nExample:\n\u003cimg src=javascript:[code]\u003e\n(requires the Microsoft Internet Explorer browser)\n\n2) Input passed to the \"user_id\" parameter in the \"Your_Home\"\nfunctionality of the \"Your_Account\" module isn\u0027t properly sanitised\nbefore being used in a SQL query. This can be exploited to manipulate\nSQL queries by injecting arbitrary SQL code. This can be further\nexploited with vulnerability #1 to inject arbitrary HTML and script\ncode into arbitrary user\u0027s personal menu. \n\nSuccessful exploitation requires that \"magic_quotes_gpc\" is\ndisabled. \n\nThe vulnerabilities have been confirmed in version 7.8. \n\nSOLUTION:\nEdit the source code to ensure that input is properly sanitised. \n\nPROVIDED AND/OR DISCOVERED BY:\nJason Lau\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "db": "BID",
        "id": "16774"
      },
      {
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "db": "PACKETSTORM",
        "id": "44052"
      }
    ],
    "trust": 1.35
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "16774",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "18972",
        "trust": 1.8
      },
      {
        "db": "VUPEN",
        "id": "ADV-2006-0687",
        "trust": 1.7
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1847",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "23432",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293",
        "trust": 0.7
      },
      {
        "db": "XF",
        "id": "44730",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-17955",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "44052",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "db": "BID",
        "id": "16774"
      },
      {
        "db": "PACKETSTORM",
        "id": "44052"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "id": "VAR-200604-0374",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17955"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:24:03.924000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/16774"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/23432"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/18972"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2006/0687"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44730"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/44730"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2006/0687"
      },
      {
        "trust": 0.3,
        "url": "http://www.phpnuke.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/2385/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/18972/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "db": "BID",
        "id": "16774"
      },
      {
        "db": "PACKETSTORM",
        "id": "44052"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "db": "BID",
        "id": "16774"
      },
      {
        "db": "PACKETSTORM",
        "id": "44052"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-04-19T00:00:00",
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "date": "2005-11-08T00:00:00",
        "db": "BID",
        "id": "16774"
      },
      {
        "date": "2006-02-22T19:02:22",
        "db": "PACKETSTORM",
        "id": "44052"
      },
      {
        "date": "2006-04-19T16:06:00",
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "date": "2006-04-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-17955"
      },
      {
        "date": "2006-02-23T18:57:00",
        "db": "BID",
        "id": "16774"
      },
      {
        "date": "2017-07-20T01:30:57.473000",
        "db": "NVD",
        "id": "CVE-2006-1847"
      },
      {
        "date": "2006-04-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "PHP-Nuke  Your_Account Module  SQL Injection vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "sql injection",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "44052"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200604-293"
      }
    ],
    "trust": 0.7
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.