OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[Full-disclosure] Re: [waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module

From: Paul Laudanski (zxcastlecops.com)
Date: Sat Apr 09 2005 - 00:20:35 CDT

On 7 Apr 2005, Janek Vind wrote:
> http://localhost/nuke76/modules.php?name=Top&querylang=%20WHERE%201=2%20UNION
> %20ALL%20SELECT%201,pwd,1,1%20FROM%20nuke_authors/*
>
> ... and as result we can see md5 hashes of all the admin passwords in place, where normally
> top 10 votes can be seen :)

Again as before, code should be validating input. But as a simple
precaution against default GET attacks, changing the table prefix from the
common "nuke_" to something random like "zloqf7_" would render that
sample, and all others based on "nuke_" useless.

Of course in the grander scheme that isn't foolproof, but does work
against the default GETs.

--
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/