Nuked-Klan contains a flaw that may allow an attacker to carry out an SQL injection attack. Input passed to the "Referer" HTTP header is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. This may allow an attacker to inject or manipulate SQL queries in the back-end database.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Public
Disclosure:
Uncoordinated Disclosure
OSVDB:
Web Related
Solution
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround:
Set "Level required to view the analyze of the visits" in General preferences to "Disable".
