PT-2008-2093 · Php · Php-Nuke

1Dt.W0Lf + 1 · Published 2008-01-25 · Updated 2017-09-29 · CVE-2008-0461

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 8.0 FINAL and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This can be achieved via the sid parameter in a comments action to "modules.php".

Recommendations For PHP-Nuke versions 8.0 FINAL and earlier, consider disabling the comments action to modules.php or restricting access to it until a fix is available. Additionally, enabling magic quotes gpc can help mitigate the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-0461

Affected Products

Php-Nuke

References · 7

• 🔥 http://securityfocus.com/bid/27408 · Exploit
• 🔥 https://exploit-db.com/exploits/4965 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0461 · Security Note
• http://secunia.com/advisories/28624 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0264 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39850 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0461 · Note