PT-2007-2462 · Php Nuke Team · Php-Nuke

Ajann

·

CVE-2007-1034

·

Published

2007-02-21

·

Updated

2018-10-19

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Emporium module for PHP-Nuke versions 2.3.0 and earlier
Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the category id parameter in the category file in modules.php.
Recommendations: For Emporium module for PHP-Nuke versions 2.3.0 and earlier, consider restricting access to the vulnerable category id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2007-1034

Affected Products

Php-Nuke