PT-2005-2020 · Php Nuke · Php-Nuke

Cxib8O3 + 1 · Published 2005-04-07 · Updated 2016-10-18 · CVE-2005-0997

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.6

Description The issue concerns SQL injection vulnerabilities in the Web Links module. Remote attackers can execute arbitrary SQL commands through various parameters in different functions, including email or url in the Add function, url in the modifylinkrequestS function, orderby or min in the viewlink function, orderby, min, or show in the search function, or ratenum in the MostPopular function.

Recommendations For PHP-Nuke version 7.6, consider restricting access to the Web Links module until a fix is available. As a temporary workaround, avoid using the vulnerable parameters email, url, orderby, min, show, and ratenum in their respective functions. Additionally, restrict the use of the modifylinkrequestS, viewlink, search, and MostPopular functions to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-0997

Affected Products

Php-Nuke

References · 4

• 🔥 https://exploit-db.com/exploits/25360 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0997 · Security Note
• http://marc.info/?l=bugtraq&m=111289685724764&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0997 · Note