High-Tech Bridge SA has discovered some vulnerabilities in Hycus CMS, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed via the "user_name" and "usr_email" parameters to user/1/hregister.html, the "usr_email" parameter to user/1/hlogin.html, the "useremail" parameter to user/1/forgotpass.html, and the "q" parameter to search/1.html is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires that "magic_quotes_gpc" is disabled.

The vulnerabilities are confirmed in version 1.0.3. Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly sanitised.

Provided and/or discovered by
High-Tech Bridge SA

Changelog
Further details available to Secunia VIM customers

Original Advisory
High-Tech Bridge SA:
http://www.htbridge.ch/advisory/sql_injection_in_hycus_cms.html
http://www.htbridge.ch/advisory/sql_injection_in_hycus_cms_1.html
http://www.htbridge.ch/advisory/sql_injection_in_hycus_cms_2.html
http://www.htbridge.ch/advisory/sql_injection_in_hycus_cms_3.html

Deep Links
Links available to Secunia VIM customers