CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Francisco Burzi : Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-6376 22 Dir. Trav. 2007-12-14 2008-11-15
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filename parameter, a different vector than CVE-2006-4190. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
2 CVE-2007-0372 Exec Code Sql 2007-01-19 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/admin/index.php; or unspecified vectors in the (7) advertising, (8) weblinks, or (9) reviews section.
3 CVE-2007-0309 Exec Code Sql 2007-01-17 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
4 CVE-2006-6234 Exec Code Sql 2006-12-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action.
5 CVE-2006-6200 Exec Code Sql 2006-11-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.
6 CVE-2006-5720 Exec Code Sql 2006-11-03 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.
7 CVE-2006-1847 Exec Code Sql 2006-04-19 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
8 CVE-2006-0908 Sql Bypass 2006-02-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.
9 CVE-2006-0907 Exec Code Sql Bypass 2006-02-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.
10 CVE-2006-0805 Bypass 2006-02-20 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The CAPTCHA functionality in php-Nuke 6.0 through 7.9 uses fixed challenge/response pairs that only vary once per day based on the User Agent (HTTP_USER_AGENT), which allows remote attackers to bypass CAPTCHA controls by fixing the User Agent, performing a valid challenge/response, then replaying that pair in the random_num and gfx_check parameters.
11 CVE-2006-0679 Exec Code Sql 2006-02-16 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field).
12 CVE-2006-0163 Exec Code Sql 2006-01-11 2008-10-03
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792.
13 CVE-2005-4715 Exec Code Sql Bypass 2005-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) sid, and (3) pid parameters in a POST request, which bypasses security checks that are performed for GET requests.
14 CVE-2005-3792 Exec Code Sql 2005-11-24 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote attackers to execute arbitrary SQL commands, as demonstrated via the query parameter in a stories type.
15 CVE-2005-3304 Exec Code Sql 2005-10-25 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the Web_Links module.
16 CVE-2005-0999 Exec Code Sql 2005-05-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers to execute arbitrary SQL commands via the querylang parameter.
17 CVE-2005-0997 Exec Code Sql 2005-05-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlink function, (4) the orderby, min, or show parameters in the search function, or (5) the ratenum parameter in the MostPopular function.
18 CVE-2004-2295 Exec Code Sql 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
19 CVE-2004-2044 +Info 2004-06-01 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.
20 CVE-2004-2018 Exec Code File Inclusion 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code.
21 CVE-2004-2000 Sql 2004-05-05 2009-09-19
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php.
22 CVE-2004-1989 Exec Code File Inclusion 2004-04-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in theme.php in Coppermine Photo Gallery 1.2.2b allows remote attackers to execute arbitrary PHP code by modifying the THEME_DIR parameter to reference a URL on a remote web server that contains user_list_info_box.inc.
23 CVE-2004-1988 Exec Code File Inclusion 2004-04-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in init.inc.php in Coppermine Photo Gallery 1.2.0 RC4 allows remote attackers to execute arbitrary PHP code by modifying the CPG_M_DIR to reference a URL on a remote web server that contains functions.inc.php.
24 CVE-2004-1987 Exec Code 2004-04-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
picmgmtbatch.inc.php in Coppermine Photo Gallery 1.2.2b and 1.2.0 RC4 allows remote attackers with administrative privileges to execute arbitrary commands via shell metacharacters in the (1) $CONFIG['impath'] or (2) $CONFIG['jpeg_qual'] parameters.
25 CVE-2004-1972 Exec Code Sql 2004-04-26 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action.
26 CVE-2004-1932 Exec Code Sql 2004-04-12 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter.
27 CVE-2004-1929 Sql Bypass 2004-04-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.
28 CVE-2004-1914 Exec Code Sql 2004-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter.
29 CVE-2004-1842 +Priv CSRF 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.
30 CVE-2004-0738 Sql 2004-07-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters.
31 CVE-2004-0737 XSS 2004-07-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple cross-site scripting vulnerabilities in index.php in the Search module for Php-Nuke allows remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) max, (3) sel1, (4) sel2, (5) sel3, (6) sel4, (7) sel5, (8) match, (9) mod1, (10) mod2, or (11) mod3 parameters.
32 CVE-2004-0732 Sql 2004-07-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to execute arbitrary SQL statements via the instory parameter.
33 CVE-2003-1435 89 Exec Code Sql 2003-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module.
34 CVE-2003-1210 Exec Code Sql 2003-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.
35 CVE-2002-1242 +Priv Sql 2002-11-12 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.
36 CVE-2002-0206 Exec Code 2002-05-16 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter.
37 CVE-2001-1032 2001-09-24 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload operations, which allows remote attackers to copy and upload arbitrary files and read the PHP-Nuke configuration file by directly calling admin.php with an upload parameter and specifying the file to copy.
38 CVE-2001-0911 +Priv 2001-11-21 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP-Nuke 5.1 stores user and administrator passwords in a base-64 encoded cookie, which could allow remote attackers to gain privileges by stealing or sniffing the cookie and decoding it.
39 CVE-2001-0292 2001-05-03 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP-Nuke 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id (UID) and calling user.php with the saveuser operator.
40 CVE-2001-0001 Bypass 2001-06-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
cookiedecode function in PHP-Nuke 4.4 allows users to bypass authentication and gain access to other user accounts by extracting the authentication information from a cookie.
41 CVE-2000-0745 +Priv 2000-10-20 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
admin.php3 in PHP-Nuke does not properly verify the PHP-Nuke administrator password, which allows remote attackers to gain privileges by requesting a URL that does not specify the aid or pwd parameter.
Total number of vulnerabilities : 41   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.