PostNuke Input Validation Flaw in 'sortby' Variable in 'members_list' Module Permits SQL Injection
SecurityTracker Alert ID: 1008629|
SecurityTracker URL: http://securitytracker.com/id/1008629
(Links to External Site)
Date: Jan 7 2004
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information|
Fix Available: Yes Vendor Confirmed: Yes |
An input validation vulnerability was reported in PostNuke. A remote user can inject SQL commands. A remote user can also conduct cross-site scripting attacks.|
JeiAr of the GulfTech Security Research Team reported that the 'members_list' module does not properly validate user-supplied input in the 'sortby' variable. A remote user may be able to execute SQL commands on the underlying database.
It is also reported that the download module does not filter HTML code from user supplied input in the 'ttitle' variable. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the PostNuke software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit is provided (where '[VID]' is a valid file ID number):
A remote user can inject SQL commands on the target system.|
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the PostNuke software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
The vendor has released the following fixes:|
1. PostNuke Phoenix 0.726-1 (.tar.gz format)
Size/MD5 checksum: b56a5be2e88e5d6ad779a47bb4864084
2. PostNuke Phoenix 0.726-1 (.zip format)
Size/MD5 checksum: 4b5fd57053c8577eeefef50cd1d19279
3. Members_List patch for pn0.726 (.tar.gz format)
Size/MD5 checksum: 6cf971d9222821529cbf7029dcd97dcc
4. Members_List patch for pn0.726 (.zip format)
Size/MD5 checksum: d36e5b9442a688e8348cf67a1ef21f56
The author of the report indicates that the fix corrects the SQL injection flaw and that a future fix will correct the cross-site scripting flaw.
Vendor URL: lists.postnuke.com/pipermail/postnuke-security/2004q1/000001.html (Links to External Site)
Input validation error|
|Underlying OS: Linux (Any), UNIX (Any), Windows (Any)|
Source Message Contents
Subject: PostNuke Issues (0.726 && Possibly Older)|
Vendor : PostNuke
URL : http://www.postnuke.com
Version : PostNuke 0.726 Phoenix && Older(??)
Risk : SQL Injection && XSS
Postnuke is a popular Open Source CMS (Content Managment System) used
by millions of people all across the world.
SQL Injection is possible by passing unexpected data to the "sortby" variable
in the "members_list" module. This vulnerability may allow an attacker to
manipulate queries as well as view the full physical path of the postnuke
installation. This is due to user input not being properly sanatized.
Cross Site Scripting:
XSS is possible via the download module by injecting HTML or Script into the
"ttitle" variable when viewing the details of an item for download. Example:
Where [VID] is should be the valid id number of a file for download.
An update has been released regarding the SQL Injection vulnerability. The XSS
vuln however will not be fixed until future releases of PostNuke as it is really
not possible to HiJack a users postnuke session, thus limiting the chances of
this being harmful to any users or administrators. Much respect to the postnuke
Dev team and especially Andreas Krapohl aka larsneo for being very prompt and
professional about issuing a fix for this immediately. The fixed may be obtained
from the official PostNuke website at http://www.postnuke.com
Credits go to JeiAr of the GulfTech Security Research Team.
Hope everyone had a good Christmas/Hanukkah/Kwanza and a Happy New Year :o)