PT-2005-2019 · Php · Php-Nuke

Cxib8O3 + 1 · Published 2005-04-07 · Updated 2016-10-18 · CVE-2005-0996

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.6

Description The issue concerns SQL injection vulnerabilities in the Downloads module. Remote attackers can inject arbitrary web script or HTML via specific parameters, including the email or url parameters in the Add function, the min parameter in the viewsdownload function, or the min parameter in the search function.

Recommendations For PHP-Nuke version 7.6, consider restricting access to the vulnerable parameters email, url, and min in the affected functions until a patch is available. As a temporary workaround, disabling the Downloads module or limiting its functionality can help minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-0996

Affected Products

Php-Nuke

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-0996 · Security Note
• http://marc.info/?l=bugtraq&m=111289685724764&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0996 · Note