PHP-Nuke DownloadsPlus Module - Arbitrary File Upload

PHP-Nuke DownloadsPlus Module - Arbitrary File Upload source: https://www.securityfocus.com/bid/28919/info The DownloadsPlus module for PHP-Nuke is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because the application fails to sanitize user-supplied input...

PHP-Nuke DownloadsPlus Module - Arbitrary File Upload

source: https://www.securityfocus.com/bid/28919/info The DownloadsPlus module for PHP-Nuke is prone to a vulnerability that lets remote attackers upload and execute arbitrary code because the application fails to sanitize user-supplied input. This issue permits attackers to upload arbitrary files...

Deciphering the PHP-Nuke Capthca

The Capthca used in the current version 8.1 of PHP Nuke can be deciphered with 100 accuracy. more information can be found her: http://www.rooksecurity.com/blog/?p=6 Exploit Code: http://www.rooksecurity.com/exploits/phpnukecaptcha.zip What is so interesting about this captcha is that it is...

CVE-2008-1873

Cross-site scripting XSS vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of...

Cross site scripting

Cross-site scripting XSS vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of...

CVE-2008-1873

CVE-2008-1873 is a cross-site scripting (XSS) vulnerability in Nuke ET’s private message feature affecting Nuke ET 3.2 and 3.4. The flaw allows remote authenticated users to inject arbitrary script/HTML via a CSS property in the STYLE attribute of a DIV element within the mensaje parameter, with ...

CVE-2008-1873

Cross-site scripting XSS vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document...

CVE-2008-1719

Multiple cross-site request forgery CSRF vulnerabilities in Nuke ET 3.2 and 3.4 allow remote attackers to perform actions as administrators, as demonstrated by inserting an XSS sequence into a document...

CVE-2008-1719

CVE-2008-1719 affects Nuke ET versions 3.2 and 3.4. The issue consists of multiple CSRF vulnerabilities that could allow remote attackers to perform actions as administrators, demonstrated via inserting an XSS sequence into a document. The provided documents do not specify a remediation or patch ...

Information disclosure

PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magicquotesgpc...

CVE-2008-1680

PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magicquotesgpc...

Nuke ET 3.4 - mensaje HTML Injection

Nuke ET 3.4 - mensaje HTML Injection source: https://www.securityfocus.com/bid/28614/info Nuke ET is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Attackers will likely require access to a user account to perform attacks. Exploiting...

CVE-2008-1680

PHP-Nuke Platinum 7.6.b.5 allows remote attackers to obtain configuration information via a direct request to maintenance/index.php, which reveals settings such as magicquotesgpc...

CVE-2008-1680

CVE-2008-1680 affects PHP-Nuke Platinum 7.6.b.5, where a direct request to maintenance/index.php allows remote attackers to disclose configuration information, including settings such as magic_quotes_gpc. The issue is categorized as information disclosure with a CVSS v2 base score of 5.0 (Network...

CVE-2008-1539

SQL injection vulnerability in includes/dynamictitles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module...

Sql injection

SQL injection vulnerability in includes/dynamictitles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module...

CVE-2008-1539

SQL injection vulnerability in includes/dynamictitles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module...

CVE-2008-1539

CVE-2008-1539 : Vulnerability in PHP-Nuke Platinum 7.6.b.5 where SQL injection occurs in includes/dynamic_titles.php. An attacker can send crafted requests to the Forums module (via the p parameter to modules.php) to execute arbitrary SQL commands remotely. The CVE is documented with a high impac...

phpnukeplat-sql.txt

!/usr/bin/perl Inphex use LWP::UserAgent; use LWP::Simple; use IO::Socket; use Switch; PHP-Nuke Platinum , ForumsStandart - magicquotesgpc = OFF , SQL Injection nukeusers Structure: userid name username useremail femail userwebsite useravatar userregdate usericq userocc userfrom userinterests...