CVE-2006-0907 — SQL Injection in Burzi Php-nuke

6 documents4 sources

Severity

7.5HIGHNVD

EPSS

0.0%

top 96.46%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Francisco Burzi Php-nuke

Timeline

PublishedFeb 28

Latest updateMay 1

Description

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDfrancisco_burzi/php-nuke7.8

🔴Vulnerability Details

GHSA

GHSA-vc7f-952f-fcmv: SQL injection vulnerability in PHP-Nuke before 7↗2022-05-01

▶

CVEList

CVE-2006-0907: SQL injection vulnerability in PHP-Nuke before 7↗2006-02-28

▶

💬Community

Bugzilla

CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)↗2007-02-20

▶

Bugzilla

CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)↗2007-02-16

▶