SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   PostNuke Vendors:   postnuke.com
PostNuke Input Validation Flaw in 'sortby' Variable in 'members_list' Module Permits SQL Injection
SecurityTracker Alert ID:  1008629
SecurityTracker URL:  http://securitytracker.com/id/1008629
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 7 2004
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 0.726
Description:   An input validation vulnerability was reported in PostNuke. A remote user can inject SQL commands. A remote user can also conduct cross-site scripting attacks.

JeiAr of the GulfTech Security Research Team reported that the 'members_list' module does not properly validate user-supplied input in the 'sortby' variable. A remote user may be able to execute SQL commands on the underlying database.

It is also reported that the download module does not filter HTML code from user supplied input in the 'ttitle' variable. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the PostNuke software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit is provided (where '[VID]' is a valid file ID number):

name=Downloads&file=index&req=viewdownloaddetails&lid=[VID]&ttitle="><iframe>

Impact:   A remote user can inject SQL commands on the target system.

A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the PostNuke software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Solution:   The vendor has released the following fixes:

1. PostNuke Phoenix 0.726-1 (.tar.gz format)
http://download.postnuke.com/pafiledb.php?action=file&id=34
Size/MD5 checksum: b56a5be2e88e5d6ad779a47bb4864084

2. PostNuke Phoenix 0.726-1 (.zip format)
http://download.postnuke.com/pafiledb.php?action=file&id=33
Size/MD5 checksum: 4b5fd57053c8577eeefef50cd1d19279

3. Members_List patch for pn0.726 (.tar.gz format)
http://download.postnuke.com/pafiledb.php?action=file&id=42
Size/MD5 checksum: 6cf971d9222821529cbf7029dcd97dcc

4. Members_List patch for pn0.726 (.zip format)
http://download.postnuke.com/pafiledb.php?action=file&id=41
Size/MD5 checksum: d36e5b9442a688e8348cf67a1ef21f56

The author of the report indicates that the fix corrects the SQL injection flaw and that a future fix will correct the cross-site scripting flaw.

Vendor URL:  lists.postnuke.com/pipermail/postnuke-security/2004q1/000001.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  PostNuke Issues (0.726 && Possibly Older)




Vendor  : PostNuke
URL     : http://www.postnuke.com
Version : PostNuke 0.726 Phoenix && Older(??)
Risk    : SQL Injection && XSS



Description:
Postnuke is a popular Open Source CMS (Content Managment System) used
by millions of people all across the world. 



SQL Injection:
SQL Injection is possible by passing unexpected data to the "sortby" variable
in the "members_list" module. This vulnerability may allow an attacker to
manipulate queries as well as view the full physical path of the postnuke
installation. This is due to user input not being properly sanatized.



Cross Site Scripting:
XSS is possible via the download module by injecting HTML or Script into the 
"ttitle" variable when viewing the details of an item for download. Example:

name=Downloads&file=index&req=viewdownloaddetails&lid=[VID]&ttitle="><iframe>

Where [VID] is should be the valid id number of a file for download. 



Solution:
An update has been released regarding the SQL Injection vulnerability. The XSS
vuln however will not be fixed until future releases of PostNuke as it is really
not possible to HiJack a users postnuke session, thus limiting the chances of
this being harmful to any users or administrators. Much respect to the postnuke
Dev team and especially Andreas Krapohl aka larsneo for being very prompt and 
professional about issuing a fix for this immediately. The fixed may be obtained
from the official PostNuke website at http://www.postnuke.com



Credits:
Credits go to JeiAr of the GulfTech Security Research Team.
http://www.gulftech.org



Hope everyone had a good Christmas/Hanukkah/Kwanza and a Happy New Year :o)

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC