Ravens PHP Scripts

TITLE: PHP-Nuke query SQL Injection Vulnerability
SECUNIA ADVISORY ID: SA17543
VERIFY ADVISORY: http://secunia.com/advisories/17543/
CRITICAL: Moderately critical
IMPACT: Manipulation of data
WHERE: From remote
SOFTWARE: PHP-Nuke 7.x - http://secunia.com/product/2385/
DESCRIPTION: sp3x has discovered a vulnerability in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection attacks. Input passed to the "query" parameter when performing a search isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability has been confirmed in version 7.8. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly sanitised.
PROVIDED AND/OR DISCOVERED BY: sp3x