<% dim ModuleName,InfoID,ChannelShortName,CorrelativeArticle,InstallDir,ChannelDir,Keyword,PageTitle,ArticleIntro,Articlecontent Keyword=stripHTML("issue,queries") PageTitle=stripHTML("myPHPNuke 1.8.8 auth.inc.php SQL Injection Vulnerability") ArticleIntro=stripHTML("77169.com小编引言:myPHPNuke 1.8.8 auth.inc.php SQL Injection Vulnerability,漏洞的主要原因:") Articlecontent=stripHTML("source: http://www.securityfocus.com/bid/8663/info

It has been reported that my…") ModuleName = stripHTML("exploits") InfoID = stripHTML("170578") ChannelShortName=stripHTML("漏洞") InstallDir=stripHTML("http://www.77169.com/") ChannelDir=stripHTML("exploits") %> myPHPNuke 1.8.8 auth.inc.php SQL Injection Vulnerability - 华盟网 - http://www.77169.com
您现在的位置: 华盟网 >> 漏洞 >> 最新漏洞 >> 其它漏洞 >> 正文

myPHPNuke 1.8.8 auth.inc.php SQL Injection Vulnerability

2003/9/18 作者:不祥 来源: 互联网
导读 <% if len(ArticleIntro)<3 then Response.Write Articlecontent 'Response.Write "Articlecontent" else Response.Write ArticleIntro 'Response.Write "ArticleIntro" end if %>
source: http://www.securityfocus.com/bid/8663/info

It has been reported that myPHPNuke is prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The issue may exist in the auth.in.php module of the software.

The cause of this problem is due to insufficient sanitization of user-supplied data. An attacker may be able to exploit this issue to influence SQL query logic. Successful exploitation may disclose sensitive information about the underlying database to an attacker, which may be used to launch further attacks against a vulnerable system.

myPHPNuke version 1.8.8 has been reported to be prone to this issue, however other versions may be affected as well. 

select pwd from mpn_authors where aid='mad' into outfile '/filepath/file.txt'