[32020] in bugtraq
Re: PHP-Nuke SQL Injection
daemon@ATHENA.MIT.EDU (3APA3A)
Wed Oct 8 14:08:01 2003
Date: Wed, 8 Oct 2003 20:52:27 +0400
From: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Reply-To: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Message-ID: <114447237.20031008205227@SECURITY.NNOV.RU>
To: mod <rottyfig12@hotmail.com>
Cc: bugtraq@securityfocus.com
In-Reply-To: <20031008153738.18574.qmail@sf-www3-symnsj.securityfocus.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=Windows-1251
Content-Transfer-Encoding: 8bit
Dear mod,
This SQL injection bug and another one (in web-link) in Spaiz-Nuke and
PHP-nuke was reported few days ago by 1dt.w0lf (idtwolf_at_sigaret.net)
(sorry, in Russian, but you can see exploitation examples):
http://www.security.nnov.ru/search/document.asp?docid=5201
--Wednesday, October 8, 2003, 7:37:38 PM, you wrote to bugtraq@securityfocus.com:
m> Version: PHP-Nuke 6.6
m> Language: PHP
m> Web site: phpnuke.org
m> Status: Vendor has been notified
m> There's an SQL injection hole in modules.php.
m> http://phpnuke.org/modules.php?name=Downloads&d_op=viewdownload&cid=59%20or%20cid=2
--
~/ZARAZA
Но Гарри... я безусловно отдаю предпочтение ему, за
высокую питательность и какое-то особенно нежное мясо. (Твен)
