Secunia

Janek Vind has reported three vulnerabilities in PHP-Nuke, allowing malicious people to conduct Cross Site Scripting and SQL injection attacks.

1) The "title" and "fname" parameters aren't handled properly in "/modules/News/friend.php", which can be exploited to include arbitrary script code and HTML.

This vulnerability has been reported in version 7.10.

2) In the "Reviews" and "News" modules, it is possible to include script code in the "title" parameter by hex encoding certain characters.

This vulnerability has been reported in version 7.10.

3) The "p_msg" parameter in "mainfile.php" is base64 decoded before it is used in a SQL query, which effectively bypasses magic_quotes_gpc. This can be exploited to include malicious characters, making it possible to manipulate and inject SQL queries.

A sample exploit has been released, which can extract the administrative password exploiting issue 3 if the underlying database is MySQL 4.

This vulnerability has been reported in version 6 releases and version 7.10.

Solution
Edit the source to ensure that input is properly handled and filtered.

Provided and/or discovered by
Janek Vind

Deep Links
Links available in Customer Area