CVE-2008-1591: SQL Injection
The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magicquotesruntime is enabled, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via input associated with server variables, as demonstrated by the CLIENTIP HTTP header (HTTPCLIENTIP variable).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability description for CVE-2008-1591?
CVE-2008-1591 involves the pnVarPrepForStore function in PostNuke 0.764 and earlier, which lacks input sanitization with magic_quotes_runtime enabled, allowing SQL injection attacks.
What are the potential risks associated with CVE-2008-1591?
The potential risks of CVE-2008-1591 include unauthorized execution of arbitrary SQL commands and exposure of sensitive data.
How do I fix CVE-2008-1591?
To fix CVE-2008-1591, upgrade to a version of PostNuke that is newer than 0.764 where the vulnerability is patched.
What software versions are affected by CVE-2008-1591?
CVE-2008-1591 affects PostNuke 0.764 and earlier versions.
How can I protect my system from CVE-2008-1591?
Protect your system from CVE-2008-1591 by disabling magic_quotes_runtime and implementing comprehensive input validation and sanitization.