full-disclosure - Re: [waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0504090118050.15164-100000@bugsbunny.castlecops.com>
Date: Sat Apr  9 06:20:43 2005
From: zx at castlecops.com (Paul Laudanski)
Subject: Re: [waraxe-2005-SA#041] - Critical Sql Injection
 in PhpNuke 6.x-7.6 Top module

On 7 Apr 2005, Janek Vind wrote:
> http://localhost/nuke76/modules.php?name=Top&querylang=%20WHERE%201=2%20UNION
> %20ALL%20SELECT%201,pwd,1,1%20FROM%20nuke_authors/*
> 
> ... and as result we can see md5 hashes of all the admin passwords in place, where normally
> top 10 votes can be seen :)

Again as before, code should be validating input.  But as a simple 
precaution against default GET attacks, changing the table prefix from the 
common "nuke_" to something random like "zloqf7_" would render that 
sample, and all others based on "nuke_" useless.  

Of course in the grander scheme that isn't foolproof, but does work 
against the default GETs.

-- 
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com