----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Nuked-Klan "Referer" SQL Injection Vulnerability

SECUNIA ADVISORY ID:
SA32271

VERIFY ADVISORY:
http://secunia.com/advisories/32271/

CRITICAL:
Highly critical

IMPACT:
Manipulation of data, Exposure of sensitive information, System
access

WHERE:
>From remote

SOFTWARE:
Nuked-Klan 1.x
http://secunia.com/advisories/product/1015/
Nuked-Klan SP4.x
http://secunia.com/advisories/product/20182/

DESCRIPTION:
Charles FOL has discovered a vulnerability in Nuked-Klan, which can
be exploited by malicious people to conduct SQL injection attacks and
compromise a vulnerable system.

Input passed to the "Referer" HTTP header is not properly sanitised
before being used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

Successful exploitation allows e.g. getting administrator
credentials, which further can be used to upload and execute
arbitrary PHP scripts, but requires that "Level required to view the
analyze of the visits" in General preferences is not set to
"Disable".

The vulnerability is confirmed in versions 1.7.7 and SP4.4. Other
versions may also be affected.

SOLUTION:
Set "Level required to view the analyze of the visits" in General
preferences to "Disable".

PROVIDED AND/OR DISCOVERED BY:
Charles FOL

ORIGINAL ADVISORY:
http://milw0rm.com/exploits/6749

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------