PT-2003-2158 · Php Nuke · Php-Nuke

Published 2003-12-31 · Updated 2017-07-11 · CVE-2003-1210

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 5.x through 6.5

Description The issue concerns SQL injection vulnerabilities in the Downloads module. Remote attackers can execute arbitrary SQL commands by manipulating the lid parameter to the getit function or the min parameter to the search function.

Recommendations For PHP-Nuke versions 5.x through 6.5, consider restricting access to the Downloads module until a fix is available. As a temporary workaround, avoid using the lid parameter in the getit function and the min parameter in the search function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2003-1210

Affected Products

Php-Nuke

References · 6

• 🔥 http://securityfocus.com/bid/7588 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2003-05/0147.html · Exploit
• 🔥 https://exploit-db.com/exploits/22597 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1210 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11984 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1210 · Note