SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.
References
Link | Resource |
---|---|
http://www.securityfocus.com/archive/1/426083/100/0/threaded | |
http://www.waraxe.us/advisory-47.html | Exploit Vendor Advisory |
Configurations
History
No history.
Information
Published : 2006-02-28 02:02
Updated : 2024-02-28 10:42
NVD link : CVE-2006-0907
Mitre link : CVE-2006-0907
CVE.ORG link : CVE-2006-0907
JSON object : View
Products Affected
francisco_burzi
- php-nuke
CWE