Signature Detail
Short Name |
HTTP:SQL:INJ:POSTNUKE |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
HTTP |
Keywords |
PostNuke modules.php Arbitrary SQL Command Injection |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: PostNuke modules.php Arbitrary SQL Command Injection
This signature detects directory traversal attempts against the modules.php script included with PostNuke. PostNuke versions 0.723 and earlier are vulnerable. Attackers can send a maliciously crafted request to the modules.php to traverse the directory structure and execute SQL queries to the PostNuke database.
Extended Description
A SQL injection vulnerability has been reported for PHP-Nuke 5.6. The vulnerability is due to insufficient sanitization of variables used to construct SQL queries in some scripts. It is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script. By injecting SQL code into variables, it may be possible for an attacker to corrupt database information.
Affected Products
- Francisco Burzi PHP-Nuke 5.6.0
References