PT-2003-2158 · Php Nuke · Php-Nuke

Publicado 2003-12-31 · Atualizado 2017-07-11 · CVE-2003-1210

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 5.x through 6.5

Description The issue concerns SQL injection vulnerabilities in the Downloads module. Remote attackers can execute arbitrary SQL commands by manipulating the lid parameter to the getit function or the min parameter to the search function.

Recommendations For PHP-Nuke versions 5.x through 6.5, consider restricting access to the Downloads module until a fix is available. As a temporary workaround, avoid using the lid parameter in the getit function and the min parameter in the search function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2003-1210

Produtos afetados

Php-Nuke

Referências · 6

• 🔥 http://securityfocus.com/bid/7588 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2003-05/0147.html · Exploit
• 🔥 https://exploit-db.com/exploits/22597 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1210 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11984 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1210 · Nota