PT-2005-2019 · Php · Php-Nuke

Cxib8O3 + 1 · Publicado 2005-04-07 · Atualizado 2016-10-18 · CVE-2005-0996

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.6

Description The issue concerns SQL injection vulnerabilities in the Downloads module. Remote attackers can inject arbitrary web script or HTML via specific parameters, including the email or url parameters in the Add function, the min parameter in the viewsdownload function, or the min parameter in the search function.

Recommendations For PHP-Nuke version 7.6, consider restricting access to the vulnerable parameters email, url, and min in the affected functions until a patch is available. As a temporary workaround, disabling the Downloads module or limiting its functionality can help minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-0996

Produtos afetados

Php-Nuke

Referências · 3

• http://marc.info/?l=bugtraq&m=111289685724764&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0996 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0996 · Nota