1920 matches found
PostNuke Reviews Index.PHP跨站脚本漏洞
PHP-Nuke是一款基于PHP的WEB应用程序。 PHP-Nuke不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是reviews模块对用户提交的WEB参数缺少过滤，提交恶意脚本代码作为参数数据，并诱使用户访问恶意链接，可导致获得目标用户敏感信息。 PostNuke 0.764 目前没有解决方案提供： http://noc.postnuke.com/...
PHP-Nuke SQL注入漏洞
PHP-Nuke是一款基于PHP的WEB应用程序。 PHP-Nuke不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意SQL代码作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Nuke 7.9 目前没有解决方案提供： http://www.php-nuke.com...
CVE-2007-0372
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...
Sql injection
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...
CVE-2007-0372
CVE-2007-0372 involves multiple SQL injection flaws in PHP-Nuke 7.9. The vulnerabilities allow remote attackers to execute arbitrary SQL commands through parameters in admin/modules/modules.php (active) and modules/Advertising/admin/index.php (ad_class, imageurl, clickurl, ad_code, position), plu...
CVE-2007-0372
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...
CVE-2007-0372: Undefined Security Weakness
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via 1 the active parameter in admin/modules/modules.php; the 2 adclass, 3 imageurl, 4 clickurl, 5 adcode, or 6 position parameter in modules/Advertising/admin/index.php;...
Sql injection
SQL injection vulnerability in blocks/block-OldArticles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter...
CVE-2007-0309
SQL injection vulnerability in blocks/block-OldArticles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter...
CVE-2007-0309
CVE-2007-0309 describes an SQL injection in PHP-Nuke 7.9 and earlier, via blocks/block-Old_Articles.php when register_globals is enabled and magic_quotes_gpc is disabled. A remote attacker can use the cat parameter to execute arbitrary SQL commands. The vulnerability is evidenced across the CVE/N...
CVE-2007-0309
SQL injection vulnerability in blocks/block-OldArticles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter...
CVE-2007-0309: Undefined Security Weakness
SQL injection vulnerability in blocks/block-OldArticles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter...
PHP-Nuke Block-Old_Articles.PHP SQL注入漏洞
PHP-Nuke是一款基于PHP的站点构架程序。 PHP-Nuke不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Block-OldArticles.PHP'脚本对用户提交的'cat'参数缺少过滤，提交恶意脚本代码作为参数数据，可导致获得敏感信息。 PHP-Nuke 7.9 PHP-Nuke 7.8 PHP-Nuke 7.7 PHP-Nuke 7.6 PHP-Nuke 7.5 PHP-Nuke 7.4 PHP-Nuke 7.3 PHP-Nuke 7.2 PHP-Nuke 7.1 PHP-Nuke 7.0 目前没有解决方案提供：...
PHP-Nuke <= 7.9 Old-Articles Block "cat" SQL Injection vulnerability
/ -------------------------------------------------------- Neo Security Team NST - Advisory 31 - 2007-01-13 -------------------------------------------------------- Program: PHP-Nuke Homepage: http://www.phpnuke.org Vulnerable Versions: PHP-Nuke = 7.9 Risk: Medium Impact: Medium Risk -==PHP-Nuke ...
phpnuke79-sql.txt
/ -------------------------------------------------------- Neo Security Team NST - Advisory 31 - 2007-01-13 -------------------------------------------------------- Program: PHP-Nuke Homepage: http://www.phpnuke.org Vulnerable Versions: PHP-Nuke = 7.9 Risk: Medium Impact: Medium Risk -==PHP-Nuke ...
PHP-Nuke 7.x - Block-Old_Articles.php SQL Injection
PHP-Nuke 7.x - Block-OldArticles.php SQL Injection source: https://www.securityfocus.com/bid/22037/info PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker t...
PHP-Nuke 7.x - 'Block-Old_Articles.php' SQL Injection
source: https://www.securityfocus.com/bid/22037/info PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...
PHP-Nuke Book Catalog Module Upload.PHP任意文件上传漏洞
PHP-Nuke Book Catalog Module是一款PHP的图书目录模块。 PHP-Nuke Book Catalog Module不正确过滤用户提交的数据，远程攻击者可以利用漏洞上传任意文件，并以WEB进程执行。 'BookCatalog/upload.php'对用户提交的图象文件缺少正确过滤，可直接提交PHP文件而导致以WEB权限执行。 SAP Basis Community Book Catalog Module 1.0 目前没有解决方案提供,请关注以下链接： http://www.basisconsultant.com/index.php...
PHP-Nuke AutoHTML本地文件包含漏洞
PHP-Nuke是一款基于PHP的站点架构程序。 PHP-Nuke不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限查看系统文件内容。 问题是'autohtml.php'脚本对用户提交的'name'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB进程权限查看系统文件内容。 PHP-Nuke AutoHTML Module 2.0 http://www.nukeaddon.com/ http://www.site.com/autohtml.php?op=modload&name=../../../../etc/passwd...
PHP-Nuke Category参数SQL注入漏洞
PHP-Nuke是一个广为流行的网站创建和管理工具，它可以使用很多数据库软件作为后端，比如MySQL、PostgreSQL、mSQL、Interbase、Sybase等。PHP-Nuke包含的'index.php'脚本对用户提交的参数缺少充分过滤，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得数据库敏感信息及修改数据库内容。当执行搜索时，index.php脚本对用户提交给$category变量的数据缺少充分过滤，提交包含SQL命令的数据作为$category变量参数，可更改原来数据库逻辑，获得数据库敏感信息及修改数据库内容。 Francisco Burzi...