PHP-Nuke "query" SQL Injection Vulnerability

[pkelly]

http://secunia.com/advisories/17543/

Description:
sp3x has discovered a vulnerability in PHP-Nuke, which can be exploited by malicious people to conduct SQL injection attacks.

Input passed to the "query" parameter when performing a search isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability has been confirmed in version 7.8. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.