security hole on download&weblinks module PHP nuke

[nuratasya]

It has been reported that the default modules of download&weblinks has a large security hole.
This seems to be an attack that works agaisnt the new abstraction layer and the old.
This new attack will list your sites admin account with aid's and passwords if you do not use the following patch.
Click read more to find how to fix it.
The patch is simple, just open modules/Downloads/index.php in an text editor and find function viewdownload and place $cid = intval($cid); right after the global line.
Same thing with the weblink module, just open modules/Web_Links/index.php in an text editor and find function viewlink and place $cid = intval($cid); right after the global line.
Several sites has been hacked with this type.

is there really a security hole on download&weblinks module PHP nuke ?
I had checked with some sites on this issues but could not found any thread or news whatsoever
Can anyone here check the validility of that security hole?
Thanks

[NaTaS]

Yes it is valid...Unfortunately. If you've upgraded to 7.0 you're fine. The versions affected up to 6.5. This is another example of the pain Mr. Bucci has had with SQL Injection exploits. PHPNuke is akin to IIS with all the troubles it has with exploits.

The exploit existed in 6.5's Web_Links and Downloads modules. A hax0r (;p) could insert arbitrary code in specific variables in a request to a script, such as the modules.php or index.php script, which would allow the them to get user passes from the backend database.

Oddly enough the Download exploit was exploitable because the plugin coder didn't use inverted comas.


Example:

www.website.com/modules.php?name=Downlo ... sql_query("update ".$prefix."_downloads_downloads set hits=hits+1 WHERE lid=$lid", $dbi); $result = sql_query("SELECT url FROM ".$prefix."_downloads_downloads WHERE lid=$lid", $dbi);

[nuratasya]

Thanks for the speedy reply.
Here the simple patch:

The patch is simple, just open modules/Downloads/index.php in an text editor and find function viewdownload and place $cid = intval($cid); right after the global line.
Same thing with the weblink module, just open modules/Web_Links/index.php in an text editor and find function viewlink and place $cid = intval($cid); right after the global line.

OR you can download HERE made by chatserv.

[PCguy]

I am updated. Thanks for the heads up.