CVE-2011-1480

SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.openwall.com/lists/oss-security/2011/03/23/7	Exploit
http://www.openwall.com/lists/oss-security/2011/03/30/6	Exploit
http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection
http://www.openwall.com/lists/oss-security/2011/03/23/7	Exploit
http://www.openwall.com/lists/oss-security/2011/03/30/6	Exploit
http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpnuke:php-nuke::::::::
	cpe:2.3:a:phpnuke:php-nuke:5.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.0.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.3.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.9:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.9:::::::*

History

21 Nov 2024, 01:26

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2011/03/23/7 - Exploit~~	() http://www.openwall.com/lists/oss-security/2011/03/23/7 - Exploit
References	~~() http://www.openwall.com/lists/oss-security/2011/03/30/6 - Exploit~~	() http://www.openwall.com/lists/oss-security/2011/03/30/6 - Exploit
References	~~() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection -~~	() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection -

07 Nov 2023, 02:07

Type	Values Removed	Values Added
References	~~{'url': 'http://yehg.net/lab/pr0js/advisories/[phpnuke-8.x]_sql_injection', 'name': 'http://yehg.net/lab/pr0js/advisories/[phpnuke-8.x]_sql_injection', 'tags': ['Broken Link'], 'refsource': 'MISC'}~~	() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_sql_injection -

Information

Published : 2011-06-21 02:52

Updated : 2024-11-21 01:26

NVD link : CVE-2011-1480

Mitre link : CVE-2011-1480

CVE.ORG link : CVE-2011-1480

JSON object : View

Products Affected

phpnuke

php-nuke

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

7.5 /10