|
PHPKIT Multiple Vulnerabilties
|
|
Secunia Advisory:
|
SA27791
|
|
|
Release Date:
|
2007-11-23
|
|
Last Update:
|
2008-01-30
|
|
Popularity:
|
5,981 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Cross Site Scripting
Manipulation of data
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | PHPKIT 1.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-6134
|
|
Description:
shadowleet and nbbn have discovered some vulnerabilities in PHPKIT, which can be exploited by malicious people to conduct SQL injection attacks and to disclose sensitive information.
1) Input passed to the "contentid" parameter in pkinc/public/article.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
2) The session ID is included in the "Referer" HTTP header when opening links contained within forum posts or private messages. This can be exploited to e.g. disclose the administrator's session ID by tricking the administrator into opening a malicious webpage.
Successful exploitation can also result in cross-site request forgery attacks.
The vulnerabilities are confirmed in version 1.6.4 pl1. Other versions may also be affected.
Solution:
Edit the source code to ensure that input is properly sanitised. Do not open untrusted web pages while being logged in to PHPKIT.
Provided and/or discovered by:
1) shadowleet
2) nbbn
Changelog:
2007-12-03: Added CVE reference.
2008-01-30: Added vulnerability #2 to the advisory. Updated "Solution" section.
Original Advisory:
1) http://milw0rm.com/exploits/4646
2) http://seclists.org/bugtraq/2008/Jan/0412.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
