Description: sp3x has discovered a vulnerability in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed to the "username" parameter (Nickname field) in the new user registration functionality of the "Your_Account" module isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The vulnerability has been confirmed in version 7.8. Other versions may also be affected.
Solution: The vulnerability has reportedly been fixed in version 7.9 with patch 3.1.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
