CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Francisco Burzi : Security Vulnerabilities (SQL Injection)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2008-0461 89 1 Exec Code Sql 2008-01-25 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php. NOTE: some of these details are obtained from third party information.
2 CVE-2007-1061 1 Exec Code Sql 2007-02-21 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header (HTTP_REFERER variable).
3 CVE-2007-0372 Exec Code Sql 2007-01-19 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the active parameter in admin/modules/modules.php; the (2) ad_class, (3) imageurl, (4) clickurl, (5) ad_code, or (6) position parameter in modules/Advertising/admin/index.php; or unspecified vectors in the (7) advertising, (8) weblinks, or (9) reviews section.
4 CVE-2007-0309 Exec Code Sql 2007-01-17 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in blocks/block-Old_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
5 CVE-2006-6234 Exec Code Sql 2006-12-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action.
6 CVE-2006-6200 Exec Code Sql 2006-11-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.
7 CVE-2006-5720 Exec Code Sql 2006-11-03 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.
8 CVE-2006-1847 Exec Code Sql 2006-04-19 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to execute arbitrary SQL commands via the user_id parameter in the Your_Home functionality. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
9 CVE-2006-0908 Sql Bypass 2006-02-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
PHP-Nuke 7.8 Patched 3.2 allows remote attackers to bypass SQL injection protection mechanisms via /%2a (/*) sequences with the "ad_click" word in the query string, as demonstrated via the kala parameter.
10 CVE-2006-0907 Exec Code Sql Bypass 2006-02-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.
11 CVE-2006-0679 Exec Code Sql 2006-02-16 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Your_Account module in PHP-Nuke 7.8 and earlier allows remote attackers to execute arbitrary SQL commands via the username variable (Nickname field).
12 CVE-2006-0163 Exec Code Sql 2006-01-11 2008-10-03
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the search module (modules/Search/index.php) of PHPNuke EV 7.7 -R1 allows remote attackers to execute arbitrary SQL commands via the query parameter, which is used by the search field. NOTE: This is a different vulnerability than CVE-2005-3792.
13 CVE-2005-4715 Exec Code Sql Bypass 2005-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in modules.php in PHP-Nuke 7.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) sid, and (3) pid parameters in a POST request, which bypasses security checks that are performed for GET requests.
14 CVE-2005-3792 Exec Code Sql 2005-11-24 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows remote attackers to execute arbitrary SQL commands, as demonstrated via the query parameter in a stories type.
15 CVE-2005-3304 Exec Code Sql 2005-10-25 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHP-Nuke 7.8 allow remote attackers to modify SQL queries and execute arbitrary PHP code via (1) the username parameter in the Your Account page, (2) the url parameter in the Downloads module, and (3) the description parameter in the Web_Links module.
16 CVE-2005-0999 Exec Code Sql 2005-05-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers to execute arbitrary SQL commands via the querylang parameter.
17 CVE-2005-0997 Exec Code Sql 2005-05-02 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlink function, (4) the orderby, min, or show parameters in the search function, or (5) the ratenum parameter in the MostPopular function.
18 CVE-2005-0996 Sql 2005-05-02 2008-09-05
5.0
 None Remote Low Not required None Partial None
Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the email or url parameters in the Add function, (2) the min parameter in the viewsdownload function, or (3) the min parameter in the search function.
19 CVE-2004-2354 Sql XSS 2004-12-31 2008-09-05
6.8
 User Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php, which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.
20 CVE-2004-2295 Exec Code Sql 2004-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
21 CVE-2004-2000 Sql 2004-05-05 2009-09-19
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php.
22 CVE-2004-1972 Exec Code Sql 2004-04-26 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action.
23 CVE-2004-1932 Exec Code Sql 2004-04-12 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter.
24 CVE-2004-1929 Sql Bypass 2004-04-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the bblogin function in functions.php in PHP-Nuke 6.x through 7.2 allows remote attackers to bypass authentication and gain access by injecting base64-encoded SQL code into the user parameter.
25 CVE-2004-1914 Exec Code Sql 2004-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter.
26 CVE-2004-0738 Sql 2004-07-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Search module in Php-Nuke allow remote attackers to execute arbitrary SQL via the (1) min or (2) categ parameters.
27 CVE-2004-0732 Sql 2004-07-27 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to execute arbitrary SQL statements via the instory parameter.
28 CVE-2004-0269 Sql 2004-11-23 2008-09-05
6.4
 None Remote Low Not required Partial Partial None
SQL injection vulnerability in PHP-Nuke 6.9 and earlier, and possibly 7.x, allows remote attackers to inject arbitrary SQL code and gain sensitive information via (1) the category variable in the Search module or (2) the admin variable in the Web_Links module.
29 CVE-2004-0266 Sql 2004-11-23 2008-09-05
5.0
 None Remote Low Not required Partial None None
SQL injection vulnerability in the "public message" capability (public_message) for Php-Nuke 6.x to 7.1.0 allows remote attackers obtain the administrator password via the c_mid parameter.
30 CVE-2003-1435 89 Exec Code Sql 2003-12-31 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the search module.
31 CVE-2003-1210 Exec Code Sql 2003-12-31 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 5.x through 6.5 allow remote attackers to execute arbitrary SQL commands via the (1) lid parameter to the getit function or the (2) min parameter to the search function.
32 CVE-2003-0279 Sql 2003-06-16 2008-09-05
2.6
 None Remote High Not required Partial None None
Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 5.x through 6.5 allows remote attackers to steal sensitive information via numeric fields, as demonstrated using (1) the viewlink function and cid parameter, or (2) index.php.
33 CVE-2002-1242 +Priv Sql 2002-11-12 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.
Total number of vulnerabilities : 33   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.