PHP-Nuke 8.0 - SQL Injection

PHP-Nuke 8.0 - SQL Injection !/usr/bin/perl 0-Day PHP-Nuke newPOST = $HostName.'modules.php?name=News'; my $Cookies = new HTTP::Cookies; my $UserAgent = new LWP::UserAgent agent = 'Mozilla/5.0', maxredirect = 0, cookiejar = $Cookies, defaultheaders = HTTP::Headers-new, or die $!; my $Referrer =...

PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module

No description provided by source. Software Link: http://www.phpnuke.org/modules.php?name=Downloads&dop=viewdownload&cid=1 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= note : This bug found by tampering passed data . coders don't sanitize and check user entry point for news rate...

Sql injection

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...

CVE-2009-1842

SQL injection vulnerability in main/tracking/userLog.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header...

Sql injection

SQL injection vulnerability in the Downloads module for PHP-Nuke 8.0 8.1.0.3.5b and earlier allows remote authenticated users to execute arbitrary SQL commands via the url parameter in the Add operation to modules.php...

PHP-Nuke 8.0 Downloads Blind Sql Injection

PHP-Nuke 8.0 Downloads Blind Sql Injection AUTHOR : Sina Yazdanmehr R3d.W0rm Discovered by : Sina Yazdanmehr R3d.W0rm Our Site : http://ircrash.com My Official WebSite : http://r3dw0rm.ir IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm Sina Yazdanmehr Download : http://phpnuke.org Dork :...

CVE-2008-0461

SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php. NOTE: some of these details are obtained from thir...

CVE-2007-6376

Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the filename parameter, a different vector than CVE-2006-4190. NOTE: the provenance of this information is unknown; the detail...

PHP-Nuke 8.0 - 'autohtml.php' Local File Inclusion

source: https://www.securityfocus.com/bid/26807/info Dance Music is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the...

PHP-Nuke 8.0 - autohtml.php Local File Inclusion

PHP-Nuke 8.0 - autohtml.php Local File Inclusion source: https://www.securityfocus.com/bid/26807/info Dance Music is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized remote user to view files and...

Cross site request forgery (csrf)

The cross-site request forgery CSRF protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTPREFERER, which allows remote attackers to conduct CSRF attacks...

CVE-2007-1520

The cross-site request forgery CSRF protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before validating the HTTPREFERER, which allows remote attackers to conduct CSRF attacks...

CVE-2007-1520

The CVE-2007-1520 issue affects PHP-Nuke 8.0 and earlier, where CSRF protection fails to verify that the SERVER superglobal is an array before validating HTTP_REFERER. This logic flaw enables CSRF attacks against vulnerable PHP-Nuke installations. The vulnerability is described in multiple source...

CVE-2007-1519

PHP-Nuke (versions 8.0 and earlier) is affected by a cross-site scripting (XSS) issue in modules.php, exploitable via the query parameter in the Downloads module search. This is a remote XSS vulnerability in PHP-Nuke INP/Downloads search path; the exact root cause is a failure to sanitize input i...

Directory traversal

Directory traversal vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...

CVE-2007-1449

CVE-2007-1449 affects PHP-Nuke 8.0 and earlier. A directory-traversal flaw in mainfile.php allows remote attackers to read arbitrary files by supplying ".." in the lang parameter, enabling partial confidentiality impact. Root cause: insufficient input validation in the lang parameter. The connect...

Php Nuke POST XSS on steroids

Php Nuke POST XSS on steroids Name Php Nuke POST XSS on steroids Systems Affected PHP =4.0.7 =5.2.1, GLOBALS OFF, Php Nuke 8.0 and others partially verified Severity Medium Vendor http://php nuke.org/ Advisory http://www.ush.it/2007/03/09/php-nuke-wild-post-xss/ Authors Francesco ascii Ongaro...

CVE-2007-1061

CVE-2007-1061 involves a SQL injection in PHP-Nuke (index.php) for PHP-Nuke 8.0 Final and earlier when the HTTP Referers block is enabled. The vulnerability allows remote attackers to inject SQL via the HTTP_REFERER header (Referer). CVSS metrics from NVD indicate a base score of 6.8 (MEDIUM) wit...

PHP-Nuke 8.0 Final - 'INSERT' Blind SQL Injection (MySQL)

!/usr/bin/perl 0day exploit for PHP-nuke = 4.0.24, using 'brute force' Coded by:Maciej krasza [email protected] Screenshot: 0day exploit for PHP-nuke new; my $zadanie = HTTP::Request-newGET = $adres; my...

PHP-Nuke 7.9 - 'Encyclopedia' SQL Injection

? / Neo Security Team - Exploit made by Paisterist on 2006-10-22 http://www.neosecurityteam.net / $host="localhost"; $path="/phpnuke/"; $prefix="nuke"; $port="80"; $fp = fsockopen$host, $port, $errno, $errstr, 30; $data="query=fooaa&eid=foo'//UNION SELECT pwd as title FROM $prefixauthors WHERE...