Francisco Burzi: >> Php-Nuke >> 2.5 Security Vulnerabilities
SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links module.
CVSS Score
6.4
EPSS Score
0.001
Published
2004-11-23
sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php.
CVSS Score
5.0
EPSS Score
0.0
Published
2002-12-31
index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter.
CVSS Score
7.5
EPSS Score
0.002
Published
2002-05-16
admin.php3 in PHP-Nuke does not properly verify the PHP-Nuke administrator password, which allows remote attackers to gain privileges by requesting a URL that does not specify the aid or pwd parameter.
CVSS Score
7.5
EPSS Score
0.001
Published
2000-10-20