PT-2005-2020 · Php Nuke · Php-Nuke

Cxib8O3 + 1 · Publicado 2005-04-07 · Atualizado 2016-10-18 · CVE-2005-0997

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.6

Description The issue concerns SQL injection vulnerabilities in the Web Links module. Remote attackers can execute arbitrary SQL commands through various parameters in different functions, including email or url in the Add function, url in the modifylinkrequestS function, orderby or min in the viewlink function, orderby, min, or show in the search function, or ratenum in the MostPopular function.

Recommendations For PHP-Nuke version 7.6, consider restricting access to the Web Links module until a fix is available. As a temporary workaround, avoid using the vulnerable parameters email, url, orderby, min, show, and ratenum in their respective functions. Additionally, restrict the use of the modifylinkrequestS, viewlink, search, and MostPopular functions to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-0997

Produtos afetados

Php-Nuke

Referências · 4

• 🔥 https://exploit-db.com/exploits/25360 · Exploit
• http://marc.info/?l=bugtraq&m=111289685724764&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0997 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0997 · Nota de Segurança