Vulnerabilities > CVE-2004-1932 - SQL-Injection vulnerability in PHP-Nuke

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

francisco-burzi

exploit available

NVD

Published: 2004-04-12

Updated: 2017-07-11

Summary

SQL injection vulnerability in (1) auth.php and (2) admin.php in PHP-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL code and create an administrator account via base64-encoded SQL in the admin parameter.

Vulnerable Configurations

Part	Description	Count
Application	Francisco_Burzi Francisco Burzi PHP Nuke 6.0 Francisco Burzi PHP Nuke 6.5 Francisco Burzi PHP Nuke 6.5_Beta1 Francisco Burzi PHP Nuke 6.5_Final Francisco Burzi PHP Nuke 6.5_Rc1 Francisco Burzi PHP Nuke 6.5_Rc2 Francisco Burzi PHP Nuke 6.5_Rc3 Francisco Burzi PHP Nuke 6.6 Francisco Burzi PHP Nuke 6.7 Francisco Burzi PHP Nuke 6.9 Francisco Burzi PHP Nuke 7.0 Francisco Burzi PHP Nuke 7.0_Final Francisco Burzi PHP Nuke 7.1 Francisco Burzi PHP Nuke 7.2	14

Exploit-Db

description	PHP-Nuke SQL Injection Edit/Save Message(s) Bug. CVE-2004-1932. Webapps exploit for php platform
id	EDB-ID:465
last seen	2016-01-31
modified	2004-09-16
published	2004-09-16
reporter	iko94
source	https://www.exploit-db.com/download/465/
title	PHP-Nuke SQL Injection Edit/Save Messages Bug

Summary

Vulnerable Configurations

Exploit-Db

References