Exploit PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection

[Exploiter]

EDB-ID

23870

Проверка EDB

1. Пройдено

Автор

JANEK VIND

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2004-03-22

source: https://www.securityfocus.com/bid/9948/info

Reportedly the MS-Analysis module is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user supplied HTTP header input before using it in an SQL query.

As a result of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue.

"http://www.example.com/search?q=Maty+Scripts%27UNION SELECT pwd from nuke_authors where name%3d%27God%27 AND IF(mid(pwd,1,1)%3d3,benchmark(150000,md5(1337)),1)/*"

Where www.example.com must be a considered a considered a valid search engine by the MS-Analysis module.