PT-2001-2174 · Php · Php-Nuke

Publicado 2001-08-31 · Atualizado 2008-09-05 · CVE-2001-1025

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 5.x

Description The issue allows remote attackers to perform arbitrary SQL operations. This is achieved by modifying the prefix variable when calling scripts that do not already define the prefix variable, such as article.php, which may include mainfile.php.

Recommendations For PHP-Nuke version 5.x, consider restricting access to scripts that do not define the prefix variable to minimize the risk of exploitation. As a temporary workaround, avoid using the prefix variable in affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2001-1025

Produtos afetados

Php-Nuke

Referências · 4

• 🔥 http://securityfocus.com/bid/3149 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0019.html · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1025 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1025 · Nota de Segurança