PT-2005-1661 · Postnuke · Postnuke

Cxib8O3 + 1 · Published 2005-03-02 · Updated 2016-10-18 · CVE-2005-0615

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.760-RC2

Description The issue concerns SQL injection vulnerabilities in certain PHP files, specifically index.php, modules.php, and admin.php. These vulnerabilities allow remote attackers to execute arbitrary SQL code by manipulating the catid parameter.

Recommendations For PostNuke version 0.760-RC2, avoid using the catid parameter in the affected API endpoints until the issue is resolved. Consider restricting access to the vulnerable PHP files, such as index.php, modules.php, and admin.php, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-0615

Affected Products

Postnuke

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-0615 · Security Note
• http://securitytracker.com/id?1013324 · Patch
• http://news.postnuke.com/Article2669.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110962819232255&w=2 · Note