PT-2007-1843 · Php · Php-Nuke

Publicado 2007-01-19 · Atualizado 2018-10-16 · CVE-2007-0372

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Nuke version 7.9

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters in different PHP files, including the active parameter in "admin/modules/modules.php", the ad class, imageurl, clickurl, ad code, or position parameter in "modules/Advertising/admin/index.php". Additionally, unspecified vectors in the advertising, weblinks, or reviews section are also affected.

Recommendations: For PHP-Nuke version 7.9, consider disabling the admin/modules/modules.php and modules/Advertising/admin/index.php files until a patch is available. Restrict access to the advertising, weblinks, and reviews sections to minimize the risk of exploitation. Avoid using the active, ad class, imageurl, clickurl, ad code, and position parameters in the affected API endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2007-0372

Produtos afetados

Php-Nuke

Referências · 11

• 🔥 http://securityfocus.com/bid/22116 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html · Exploit
• 🔥 http://hackers.ir/advisories/festival.txt · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0372 · Nota
• http://osvdb.org/33698 · Nota
• http://osvdb.org/33701 · Nota
• http://osvdb.org/33699 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0372 · Nota de Segurança
• http://securityfocus.com/archive/1/459174/100/0/threaded · Nota
• http://osvdb.org/33702 · Nota
• http://osvdb.org/33700 · Nota