That looks a lot like a *nuke (PHPNuke & forks like PostNuke). The "thold" param has a history of issues, XSS and the like, and I seem to recall it is handled by the "Sections" module in Nuke. If it's the code I think it is, there are more issues with other params which are even listed in the example below. (Hint: the op param) Cheers, Arian J. Evans FishNet Security 913.710.7085 [mobile] 816.701.2045 [office] > -----Original Message----- > From: security curmudgeon [mailto:jericho@xxxxxxxxxxxxx] > Sent: Sunday, May 21, 2006 8:43 PM > To: Mster-X@xxxxxxxxxxx > Cc: bugtraq@xxxxxxxxxxxxxxxxx > Subject: Re: modules name(Sections)SQL Injection Exploit > > > : ******************** > : By: Mr-X > : Email: Mster-X@xxxxxxxxxxx > : Subject: modules name(Sections)SQL Injection > : ******************** > : > : example:- > : > /modules.php?name=Surveys&op=results&pollID=8&mode=&order=&thold=[SQL] > > What product is this in? Searching for "modules name > sections" is not that > helpful. >
