[原文]SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action.
[CNNVD]PHP-Nuke Multiple Video Gallery Module SQL注入漏洞(CNNVD-200404-095)
PHP-Nuke Video Gallery Module 0.1 Beta 5版本中的modules.php存在SQL注入漏洞。远程攻击者可以通过在viewclip，viewcat，或voteclip行动中的(1) clipid或 (2) catid参数来执行任意SQL代码。
PHP-Nuke Video Gallery Module 0.1 Beta 5版本中的modules.php存在SQL注入漏洞。远程攻击者可以通过在viewclip，viewcat，或voteclip行动中的(1) clipid或 (2) catid参数来执行任意SQL代码。
-
公告与补丁
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com .
-
漏洞信息 (24060)
PHP-Nuke 7.2 Multiple Video Gallery Module SQL Injection Vulnerabilities (EDBID:24060)
source: http://www.securityfocus.com/bid/10215/info
Reportedly the PHP-Nuke Video Gallery module is affected by multiple SQL injection vulnerabilities. This is due to a failure of the application to properly sanitize user-supplied input prior to using it in an SQL query.
These issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewcat&catid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors
http://www.example.com/modules.php?name=Video_Gallery&l_op=viewclip&clipid=-1%20UNION%20SELECT%20name%20FROM%20nuke_authors&catid=1
http://www.example.com/modules.php?name=Video_Gallery&l_op=voteclip&clipid=-1%20UNION%20SELECT%20pwd%20FROM%20nuke_authors&catid=1
PHP-Nuke Video Gallery Module Multiple Parameter SQL Injection
Remote / Network Access
Information Disclosure,
Input Manipulation
Loss of Confidentiality,
Loss of Integrity
Exploit Public
-
漏洞描述
The Video Gallery module for PHP-Nuke contains a flaw that may allow a remote attacker to inject arbitrary SQL queries. The issue is due to multiple variables in the 'Video_Gallery' module not being properly sanitized and may allow a remote attacker to inject or manipulate SQL queries.
-
时间线
2004-04-26
Unknow
2004-04-26
Unknow
-
解决方案
Upgrade to version 0.1.beta6 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
人生不是一种享乐，而是一桩十分沉重的工作。