Products: Postnuke v 0.726 (http://www.postnuke.com) Date: 15 April 2004 Author: pokleyzz <pokleyzz_at_scan-associates.net> Contributors:sk_at_scan-associates.net shaharil_at_scan-associates.net munir_at_scan-associates.net URL: http://www.scan-associates.net
Summary: Postnuke v 0.726 and below SQL injection
Description =========== Postnuke is Web Content Management System written in PHP and using mysql as database backend.
Details ======= We have found multiple vulnerabilities in Postnuke v 0.726 as described below.
SQL Injection in NS-Comments module ----------------------------------- There is SQL injection in INSERT statement for variable "sid" in file modules/NS-Comments/index.php line 1142:
VALUES ($nextid, ".pnVarPrepForStore($pid).", ".pnVarPrepForStore($sid).", now(), '".pnVarPrepForStore($uname)."', '".pnVarPrepForStore($email)."', '".pnVarPrepForStore($url)."', '".pnVarPrepForStore($ip)."', '".pnVarPrepForStore($subject)."', '".pnVarPrepForStore($comment)."', '".pnVarPrepForStore($score)."', 0)");
This will allow Postnuke user with permission to post comment include any
character in their comment and perform XSS attack to steal other user cookies.
SQL Injection in NS-Your_Account module ---------------------------------------- There is SQL injection in UPDATE statement for variable "timezoneoffset" in file modules/NS-Your_Account/user/modules/changeinfo.php php line 334 and 354:
$column[timezone_offset]=" . pnVarPrepForStore($timezoneoffset) . "
This will allow Postnuke user to change information for other user account including Administrator password.
Workaround ========== 1) modules/NS-Comments/index.php
VALUES ($nextid, '".pnVarPrepForStore($pid)."',
'".pnVarPrepForStore($sid)."', now(), '".pnVarPrepForStore($uname)."',
'".pnVarPrepForStore($email)."',
'".pnVarPrepForStore($url)."',
'".pnVarPrepForStore($ip)."', '".pnVarPrepForStore($subject)."',
'".pnVarPrepForStore($comment)."', '".pnVarPrepForStore($score)."', 0)");2)modules/NS-Your_Account/user/modules/changeinfo.php
$column[timezone_offset]='" . pnVarPrepForStore($timezoneoffset) . "'
Proof of concept ================ [http://www.scan-associates.net/papers/post_nuker.php.txt]
Vendor Response
===============
05 February 2004 - [EMAIL PROTECTED] contacted through email. no response.
07 April 2004 - [EMAIL PROTECTED] contacted through email. no response.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
