CVE-2004-1932 in PHP-Nuke
Summary
by MITRE
SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/01/2025
This vulnerability exists in PHP-Nuke versions 6.x through 7.2 where the authentication and administration scripts fail to properly validate user input. The flaw manifests in two primary files: auth.php and admin.php, both of which process the admin parameter without adequate sanitization. Attackers can exploit this weakness by submitting base64-encoded SQL commands through the admin parameter, which then gets executed within the database context. This represents a classic SQL injection vulnerability that falls under CWE-89, which specifically addresses improper neutralization of special elements used in SQL commands. The vulnerability enables remote attackers to execute arbitrary SQL code on the underlying database server, effectively bypassing authentication mechanisms and gaining unauthorized access to the system.
The operational impact of this vulnerability is severe as it allows attackers to escalate privileges and create administrator accounts within the PHP-Nuke system. When the base64-encoded SQL payload is processed, it can manipulate the database to insert new administrative user accounts with full system privileges. This creates a persistent backdoor that attackers can use to maintain access even after the initial exploit is discovered. The vulnerability also enables data manipulation, including reading, modifying, or deleting sensitive information stored within the application's database. The attack vector is particularly dangerous because it operates remotely without requiring any prior authentication credentials, making it an attractive target for automated exploitation tools.
The technical exploitation requires understanding of both SQL injection principles and PHP-Nuke's internal processing mechanisms. Attackers must craft payloads that are base64-encoded to bypass simple input filters while ensuring the SQL commands will execute successfully against the target database schema. This vulnerability aligns with ATT&CK technique T1078 which covers valid accounts and T1190 which covers exploit public-facing applications. The flaw demonstrates poor input validation practices and inadequate parameter sanitization, which are fundamental security weaknesses that violate secure coding guidelines. Organizations running affected PHP-Nuke versions face significant risk of complete system compromise, data breaches, and potential lateral movement within their network infrastructure. The vulnerability's persistence stems from its ability to create legitimate administrative accounts that can bypass normal security controls and access restricted system functions.
Mitigation strategies should include immediate patching of affected PHP-Nuke installations to version 7.3 or later where the vulnerability has been addressed. Organizations should implement proper input validation and parameter sanitization throughout their applications, particularly in authentication and administrative modules. The use of prepared statements and parameterized queries can prevent SQL injection attacks by separating SQL commands from data. Network-level protections such as web application firewalls and intrusion detection systems can help detect and block malicious payloads. Additionally, regular security assessments and code reviews should be conducted to identify similar vulnerabilities in other applications. System administrators should also implement principle of least privilege and regularly audit administrative accounts to detect unauthorized access. The vulnerability highlights the importance of maintaining up-to-date software and following secure coding practices to prevent exploitation of known weaknesses in web applications.