PT-2001-2174 · Php · Php-Nuke

Published 2001-08-31 · Updated 2008-09-05 · CVE-2001-1025

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 5.x

Description The issue allows remote attackers to perform arbitrary SQL operations. This is achieved by modifying the prefix variable when calling scripts that do not already define the prefix variable, such as article.php, which may include mainfile.php.

Recommendations For PHP-Nuke version 5.x, consider restricting access to scripts that do not define the prefix variable to minimize the risk of exploitation. As a temporary workaround, avoid using the prefix variable in affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2001-1025

Affected Products

Php-Nuke

References · 4

• 🔥 http://securityfocus.com/bid/3149 · Exploit
• 🔥 http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0019.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1025 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1025 · Note