PT-2012-1326 · Php Nuke · Php-Nuke

Amin Shokohi + 1 · Published 2012-02-14 · Updated 2019-07-01 · CVE-2010-5083

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 8.0

Description A SQL injection issue exists in the Web Links module, allowing remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the url parameter in an Add action to modules.php.

Recommendations For PHP-Nuke version 8.0, consider restricting access to the Web Links module until a patch is available. As a temporary workaround, avoid using the url parameter in the Add action to modules.php to minimize the risk of exploitation.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2010-5083

Affected Products

Php-Nuke

References · 6

• 🔥 https://exploit-db.com/exploits/14589 · Exploit
• 🔥 http://itsecteam.com/en/vulnerabilities/vulnerability58.htm · Exploit
• 🔥 http://exploit-db.com/exploits/14589 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-5083 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61012 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5083 · Note