CVE-2003-1400: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the YourAccount module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the useravatar parameter...

CVE-2003-1340

CVE-2003-1340 refers to multiple SQL injection vulnerabilities in PHP-Nuke 5.6 and 6.5. The flaws allow remote authenticated users to inject SQL via a uid cookie to modules.php and via an aid cookie to the Web_Links module using actions such as viewlink, MostPopular, or NewLinksDate. The cited so...

CVE-2003-1340

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via 1 a uid user cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid admin cookie to the WebLinks module in ...

CVE-2003-1340: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via 1 a uid user cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid admin cookie to the WebLinks module in ...

[waraxe-2007-SA#054] - Local File Inclusion in Dance Music module for phpNuke

waraxe-2007-SA054 - Local File Inclusion in Dance Music module for phpNuke ============================================================================ Author: Janek Vind "waraxe" Date: 25. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-54.html Target software...

waraxe-2007-SA054.txt

waraxe-2007-SA054 - Local File Inclusion in Dance Music module for phpNuke ============================================================================ Author: Janek Vind "waraxe" Date: 25. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-54.html Target software...

PHP-Nuke Dance Music Module - 'index.php' Local File Inclusion

source: https://www.securityfocus.com/bid/25806/info Dance Music is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the...

PHP-Nuke Dance Music Module - index.php Local File Inclusion

PHP-Nuke Dance Music Module - index.php Local File Inclusion source: https://www.securityfocus.com/bid/25806/info Dance Music is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized remote user to vi...

CVE-2007-5069

Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. dot dot in the modulename parameter...

CVE-2007-5069

Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. dot dot in the modulename parameter...

CVE-2007-5069

CVE-2007-5069 : A directory traversal flaw in the Nuke Mobile Entertainment 1 addon for PHP-Nuke affects the file data/compatible.php. The vulnerability allows remote attackers to perform local file inclusion by supplying a .. (dot dot) in the module_name parameter, enabling the execution of arbi...

CVE-2007-5069: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in data/compatible.php in the Nuke Mobile Entertainment 1 addon for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. dot dot in the modulename parameter...

PHP-Nuke addon Nuke Mobile Entartainment LFI Vulnerability

No description provided by source. Nuke Mobile Entartainment = modulename Local File Include Vuln Script : Nuke Mobile Entartainment Version : 1 Download : http://www.suonerie-polifoniche-gratis.net/mobilentertainment.zip BorN To K!LL AsbMay's Group ... Vuln. Code : include...

PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion

PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion Nuke Mobile Entartainment AsbMay's Group ... Vuln. Code : include 'modules/'.$modulename.'compatibility/data/marque.data.php'; ExploiT : path/data/compatible.php?modulename=Local File%00 Greetings 2 : str0ke - Dr.2 - AsbMay's Gro...

PHP-Nuke addon Nuke Mobile Entartainment LFI Vulnerability

Exploit for unknown platform in category web applications ========================================================== PHP-Nuke addon Nuke Mobile Entartainment LFI Vulnerability ========================================================== Nuke Mobile Entartainment AsbMay's Group ... Vuln. Code :...

PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion

Nuke Mobile Entartainment AsbMay's Group ... Vuln. Code : include 'modules/'.$modulename.'compatibility/data/marque.data.php'; ExploiT : path/data/compatible.php?modulename=Local File%00 Greetings 2 : str0ke - Dr.2 - AsbMay's Group - GoLdM - KuWaiT SeCuriTy milw0rm.com 2007-09-23...

CVE-2007-5032

Cross-site request forgery CSRF vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified addname and addradminsuper parameters...

CVE-2007-5032

CVE-2007-5032 is a Cross-site request forgery (CSRF) in admin.php of Francisco Burzi’s PHP-Nuke. An attacker can add administrative accounts by sending a request that abuses AddAuthor with crafted add_name/add_radminsuper parameters. Documented impact includes partial confidentiality, integrity, ...

CVE-2007-5032

Cross-site request forgery CSRF vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified addname and addradminsuper parameters...

PHP-Nuke add admin ALL Versions

Paste this code into an HTML page then link it to victim victim must be admin iframe name="aiuto" frameborder="0" height="0" width="0"/iframe FORM name="Faiuto" ACTION="http://VICTIMURL/nuke/admin.php" target="aiuto" METHOD=POST input type=hidden NAME="addname" value="ATTACKER" input type=hidden...