PT-2008-2093 · Php · Php-Nuke

1Dt.W0Lf + 1 · Publicado 2008-01-25 · Atualizado 2017-09-29 · CVE-2008-0461

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 8.0 FINAL and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This can be achieved via the sid parameter in a comments action to "modules.php".

Recommendations For PHP-Nuke versions 8.0 FINAL and earlier, consider disabling the comments action to modules.php or restricting access to it until a fix is available. Additionally, enabling magic quotes gpc can help mitigate the risk of exploitation.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-0461

Produtos afetados

Php-Nuke

Referências · 7

• 🔥 http://securityfocus.com/bid/27408 · Exploit
• 🔥 https://exploit-db.com/exploits/4965 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0461 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0264 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39850 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0461 · Nota
• http://secunia.com/advisories/28624 · Aviso do Fabricante