PT-2006-6830 · Php Nuke · Php-Nuke

Paisterist · Publicado 2006-12-01 · Atualizado 2018-10-17 · CVE-2006-6200

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 7.9 and earlier

Description The issue concerns SQL injection vulnerabilities in the rate article and rate complete functions within the News module of PHP-Nuke. These vulnerabilities can be exploited when magic quotes gpc is disabled, allowing remote attackers to execute arbitrary SQL commands via the sid parameter.

Recommendations For PHP-Nuke versions 7.9 and earlier, consider disabling the rate article and rate complete functions in the News module until a patch is available. Restrict access to the News module to minimize the risk of exploitation. Avoid using the sid parameter in affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-6200

Produtos afetados

Php-Nuke

Referências · 10

• 🔥 http://securityfocus.com/bid/21277 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30525 · Nota
• http://vupen.com/english/advisories/2006/4739 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6200 · Nota de Segurança
• http://securityreason.com/securityalert/1935 · Nota
• http://securitytracker.com/id?1017282 · Aviso do Fabricante
• http://secunia.com/advisories/23128 · Aviso do Fabricante
• http://securityfocus.com/archive/1/452553/100/0/threaded · Nota
• http://neosecurityteam.net/index.php?action=advisories&id=30 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6200 · Nota