PT-2006-6830 · Php Nuke · Php-Nuke

Paisterist · Published 2006-12-01 · Updated 2018-10-17 · CVE-2006-6200

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 7.9 and earlier

Description The issue concerns SQL injection vulnerabilities in the rate article and rate complete functions within the News module of PHP-Nuke. These vulnerabilities can be exploited when magic quotes gpc is disabled, allowing remote attackers to execute arbitrary SQL commands via the sid parameter.

Recommendations For PHP-Nuke versions 7.9 and earlier, consider disabling the rate article and rate complete functions in the News module until a patch is available. Restrict access to the News module to minimize the risk of exploitation. Avoid using the sid parameter in affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-6200

Affected Products

Php-Nuke

References · 10

• 🔥 http://securityfocus.com/bid/21277 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6200 · Security Note
• http://securitytracker.com/id?1017282 · Vendor Advisory
• http://secunia.com/advisories/23128 · Vendor Advisory
• http://neosecurityteam.net/index.php?action=advisories&id=30 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30525 · Note
• http://vupen.com/english/advisories/2006/4739 · Note
• http://securityreason.com/securityalert/1935 · Note
• http://securityfocus.com/archive/1/452553/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6200 · Note