PT-2011-4674

Name of the Vulnerable Software and Affected Versions Francisco Burzi PHP-Nuke version 8.0 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing certain files, such as themes/Odyssey/theme.php, which reveal...

CVE-2011-1481: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 sendername or 2 senderemail parameter in a Feedback action to modules.php...

CVE-2011-1480: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chnguid parameter...

CVE-2011-1482: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 add user accounts or 2 grant the administrative privilege to a user account, related to a...

CVE-2009-1842: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...

CVE-2008-3573: Undefined Security Weakness

The CAPTCHA implementation in 1 Pligg 9.9.5 and possibly 2 Francisco Burzi PHP-Nuke 8.1 provides a critical random number the tsrandom value within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value wit...

CVE-2008-2020: Use of Insufficiently Random Values

The CAPTCHA implementation as used in 1 Francisco Burzi PHP-Nuke 7.0 and 8.1, 2 my123tkShop e-Commerce-Suite aka 123tkShop 0.9.1, 3 phpMyBitTorrent 1.2.2, 4 TorrentFlux 2.3, 5 e107 0.7.11, 6 WebZE 0.5.9, 7 Open Media Collectors Database aka OpenDb 1.5.0b4, and 8 Labgab 1.1 uses a codebg.jpg...

CVE-2003-1340: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 5.6 and 6.5 allow remote authenticated users to execute arbitrary SQL commands via 1 a uid user cookie to modules.php; and allow remote attackers to execute arbitrary SQL commands via an aid admin cookie to the WebLinks module in ...

CVE-2007-5032: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified addname and addradminsuper parameters...

CVE-2007-1061: Undefined Security Weakness

SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header HTTPREFERER variable...

CVE-2007-0372: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...

CVE-2007-0309: Undefined Security Weakness

SQL injection vulnerability in blocks/block-OldArticles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter...

CVE-2006-6200

Multiple SQL injection vulnerabilities in the 1 ratearticle and 2 ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2006-6200: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the 1 ratearticle and 2 ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2006-5720: Undefined Security Weakness

SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter...

CVE-2002-0206: Undefined Security Weakness

index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter...