Great Reviews!Need help setting up your website, installing Apache, PHP, MySQL, or RavenNuke(tm)?Need help customizing or designing scripts?Please contact us via the Contact Us option for further details and pricing.
DESCRIPTION: Maciej "krasza" Kukla has discovered a vulnerability in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection attacks.
Input passed via the "referer" HTTP header in index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability is confirmed in version 7.9 and reported in version 8.0. Other versions may also be affected.
SOLUTION: Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY: Maciej "krasza" Kukla
Posted on Thursday, February 22, 2007 @ 02:25:31 EST by Raven
Re: PHP-Nuke HTTP *referer* SQL Injection Vulnerability (Score: 1) by Gremmie on Thursday, February 22, 2007 @ 18:41:20 EST Not registered user
To fix this, you can either go into your admin panel and set "Activate HTTP Referers?" to no, and/or do the following.
In index.php, find the line of code:
if ($httpref == 1) {
Add 1 line after it so that it looks like this:
if ($httpref == 1) {
$referer = '';
Re: PHP-Nuke HTTP *referer* SQL Injection Vulnerability (Score: 1) by montego on Friday, February 23, 2007 @ 07:18:50 EST Not registered user
I am looking at the Nuke Patched version (have only looked at 7.6) and I do not believe it can be exploited. Here is the code from the patched version:
if ($httpref == 1) {
if (isset($_SERVER['HTTP_REFERER'])) {
$referer = $_SERVER['HTTP_REFERER'];
$referer = check_html($referer, "nohtml");
}
if (!empty($referer) && !stripos_clone($referer, "unknown") && !stripos_clone($referer, "bookmark") && !stripos_clone($referer, $_SERVER['HTTP_HOST'])) {
$result = $db->sql_query("INSERT INTO ".$prefix."_referer VALUES (NULL, '".$referer."')");
}
$numrows = $db->sql_numrows($db->sql_query("SELECT * FROM ".$prefix."_referer"));
if($numrows>=$httprefmax) {
$result2 = $db->sql_query("DELETE FROM ".$prefix."_referer");
}
}
HOWEVER, IMO, initializing your variables upfront is always the right thing to do! So, I am going to add Gremmies code nonetheless to RavenNuke 2.10.00.
![[Valid RSS]](http://www.ravenphpscripts.com/images/valid-rss.png "Validate my RSS feed"){kind=small}
:: 
::
