PT-2007-1781 · Php · Php-Nuke

Paisterist · Published 2007-01-18 · Updated 2018-10-16 · CVE-2007-0309

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: PHP-Nuke versions 7.9 and earlier

Description: The issue allows remote attackers to execute arbitrary SQL commands. This is possible when register globals is enabled and magic quotes gpc is disabled. The cat parameter is used for this purpose.

Recommendations: For PHP-Nuke versions 7.9 and earlier, consider disabling the register globals setting and enabling magic quotes gpc to prevent exploitation. Additionally, restrict access to the blocks/block-Old Articles.php file until a fix is available. Avoid using the cat parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-0309

Affected Products

Php-Nuke

References · 11

• 🔥 http://securityfocus.com/bid/22037 · Exploit
• 🔥 https://exploit-db.com/exploits/29453 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-0309 · Security Note
• http://securityfocus.com/archive/1/456787/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31482 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0309 · Note
• http://secunia.com/advisories/23748 · Note
• http://securityreason.com/securityalert/2153 · Note
• http://osvdb.org/32863 · Note
• http://neosecurityteam.net/advisories/PHP-Nuke--7.9-Old-Articles-Block-cat-SQL-Injection-vulnerability-31.html · Note
• http://securitytracker.com/id?1017511 · Note