Is there a patch for this? Where would I find it? (searched the forums and the bugtracker database and google)

TIA

----------------------------------------------------------

PostNuke 'pnVarPrepForStore()' SQL Injection Vulnerability
BugTraq ID: 28407
Remote: Yes
Last Updated: 2008-03-25
Relevant URL: http://www.securityfocus.com/bid/28407
Summary:
PostNuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PostNuke 0.764 is vulnerable; other versions may also be affected.

there's indeed a problem with server vars from pnGetServerVar under certain circumstances (if magic_quotes [1] are enabled server-variables are not automatically escaped for database use within pnVarPrepForStore like typical GET/POST/COOKIE vars). this can be used for a so called 'blind injection' (e.g. insert select-values into the varchar(20) ipaddr-field within the session table) when using a faked HTTP_CLIENT_IP header.


we are currently working on a patch (some backport from the .8 series) but since the problem might also affect third party libaries it might take some time for a generic solution.


as a hotfix simply disable magic_quotes completly - this way the vars are correctly escaped (recommended in .8 anyway so just ignore the warning in the administration).


to turn off magic quotes put the following line into the .htaccess file:

if your server has PHP suexec enabled you won't be able use php_flag in .htaccess file to change PHP values - in this case you can try creating a php.ini file and add something like:


[1] magic_quotes are DEPRECATED and REMOVED as of PHP 6.0.0, see us.php.net/magic_quotes for more information


phpsecinfo might also help to secure the PHP settings

--
regards from germany
..::[Zikula Application Framework]::.. ..::[SEO-Blog]::.. ..::[CMS Sicherheit]::..

That was my assessment too but I'm not a PHP or PN expert. Thanks for the expert advice. Done.

Good to know, but some of us can't afford to turn off magic quotes because important modules such as reviews and menalto gallery depend on it, and will crash if disabled.

I hope we see some fixes soon, time for PN0765 I think.

--
"A patriot must be ready to defend his country against his government." - Edward Abbey