bugtraq - Re: PHP-Nuke SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 8 Oct 2003 20:52:27 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: mod <rottyfig12@...mail.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: PHP-Nuke SQL Injection


Dear mod,

This  SQL  injection bug and another one (in web-link) in Spaiz-Nuke and
PHP-nuke  was reported few days ago by 1dt.w0lf (idtwolf_at_sigaret.net)
(sorry,   in   Russian,   but   you   can  see  exploitation  examples):
http://www.security.nnov.ru/search/document.asp?docid=5201

--Wednesday, October 8, 2003, 7:37:38 PM, you wrote to bugtraq@...urityfocus.com:



m> Version: PHP-Nuke 6.6
m> Language: PHP
m> Web site: phpnuke.org
m> Status: Vendor has been notified

m> There's an SQL injection hole in modules.php.

m> http://phpnuke.org/modules.php?name=Downloads&d_op=viewdownload&cid=59%20or%20cid=2

-- 
~/ZARAZA
Но Гарри... я безусловно отдаю предпочтение ему, за
высокую питательность и какое-то особенно нежное мясо. (Твен)