RE: modules name(Sections)SQL Injection Exploit

["Evans, Arian" <Arian.Evans@xxxxxxxxxxxxxxxxxxx>]

That looks a lot like a *nuke (PHPNuke & forks like PostNuke).

The "thold" param has a history of issues, XSS and the like, and
I seem to recall it is handled by the "Sections" module in Nuke.

If it's the code I think it is, there are more issues with other
params which are even listed in the example below.

(Hint: the op param)

Cheers,

Arian J. Evans
FishNet Security
913.710.7085 [mobile]
816.701.2045 [office]


 


 

> -----Original Message-----
> From: security curmudgeon [mailto:jericho@xxxxxxxxxxxxx] 
> Sent: Sunday, May 21, 2006 8:43 PM
> To: Mster-X@xxxxxxxxxxx
> Cc: bugtraq@xxxxxxxxxxxxxxxxx
> Subject: Re: modules name(Sections)SQL Injection Exploit
> 
> 
> : ********************
> : By: Mr-X
> : Email: Mster-X@xxxxxxxxxxx
> : Subject: modules name(Sections)SQL Injection 
> : ********************
> : 
> : example:-
> : 
> /modules.php?name=Surveys&op=results&pollID=8&mode=&order=&thold=[SQL]
> 
> What product is this in? Searching for "modules name 
> sections" is not that 
> helpful.
>