PT-2004-2952 · Nucleus · Nucleus Cms

Published 2004-12-31 · Updated 2017-07-19 · CVE-2004-2056

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nucleus CMS version 3.01

Description A SQL injection issue allows remote attackers to execute arbitrary SQL statements. This is achieved by manipulating the itemid parameter in the "action.php" file.

Recommendations For Nucleus CMS version 3.01, consider restricting access to the "action.php" file or avoiding the use of the itemid parameter until a fix is available.

Fix

Related Identifiers

CVE-2004-2056

Affected Products

Nucleus Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-2056 · Security Note
• http://secunia.com/advisories/13136 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18002 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2056 · Note
• http://marc.info/?l=bugtraq&m=109087144509299&w=2 · Note