Francisco Burzi Php-Nuke vulnerabilities

CVE-2005-1386 [MEDIUM] CVE-2005-1386: PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct reques PHP-Nuke 7.6 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) ipban.php, (2) db.php, (3) lang-norwegian.php, (4) lang-indonesian.php, (5) lang-greek.php, (6) a request to Web_Links with the portuguese language (lang-portuguese.php), (7) a request to Web_Links with the indonesian language (lang-indonesian.php), (8

CVE-2005-0999 [HIGH] CVE-2005-0999: SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers t SQL injection vulnerability in the Top module for PHP-Nuke 6.x through 7.6 allows remote attackers to execute arbitrary SQL commands via the querylang parameter.

CVE-2005-0997 [HIGH] CVE-2005-0997: Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attacke Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlink function, (4) the orderby, min, or show parameters in the sea

CVE-2005-1027 [MEDIUM] CVE-2005-1027: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attacke Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x through 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in the Your_Account module, (2) avatarcategory parameter in the Your_Account module, or (3) lid parameter in the Downloads module.

CVE-2005-1023 [MEDIUM] CVE-2005-1023: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 6.x to 7.6 allow remote attackers to inject arbitrary web script or HTML via the (1) min parameter to the Search module, (2) the categories parameter to the FAQ module, or (3) the ltr parameter to the Encyclopedia module. NOTE: the bid parameter issue in banners.php is already an item in CVE-2005

CVE-2005-0998 [MEDIUM] CVE-2005-0998: The Web_Links module for PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via an The Web_Links module for PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via an invalid show parameter, which triggers a division by zero PHP error that leaks the full pathname of the server.

CVE-2005-1001 [MEDIUM] CVE-2005-1001: PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via direct requests to (1) the PHP-Nuke 7.6 allows remote attackers to obtain sensitive information via direct requests to (1) the Surveys module with the file parameter set to comments or (2) 3D-Fantasy/theme.php, which leaks the full pathname of the web server in a PHP error message.

CVE-2005-1180 [MEDIUM] CVE-2005-1180: HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the forwarder parameter.

CVE-2005-1024 [MEDIUM] CVE-2005-1024: modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain sensitive information via a dir modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) my_headlines, (2) userinfo, or (3) search, which reveals the path in a PHP error message.

CVE-2005-0996 [MEDIUM] CVE-2005-0996: Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attacke Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the email or url parameters in the Add function, (2) the min parameter in the viewsdownload function, or (3) the min parameter in the search function.

CVE-2005-1000 [MEDIUM] CVE-2005-1000: Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module, (3) the ttitle parameter in the viewlinkdetails, viewlinkeditorial, viewlinkc

CVE-2005-0434 [MEDIUM] CVE-2005-0434: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.

CVE-2005-0433 [MEDIUM] CVE-2005-0433: Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or mis Php-Nuke 7.5 allows remote attackers to determine the full path of the web server via invalid or missing arguments to (1) db.php, (2) mainfile.php, (3) Downloads/index.php, or (4) Web_Links/index.php, which lists the path in a PHP error message.

CVE-2004-2018 [HIGH] CVE-2004-2018: PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attac PHP remote file inclusion vulnerability in index.php in Php-Nuke 6.x through 7.3 allows remote attackers to execute arbitrary PHP code by modifying the modpath parameter to reference a URL on a remote web server that contains the code.

CVE-2004-1914 [HIGH] CVE-2004-1914: SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote SQL injection vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to execute arbitrary SQL commands via the eid parameter.

CVE-2004-1913 [MEDIUM] CVE-2004-1913: Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, Cross-site scripting (XSS) vulnerability in modules.php in NukeCalendar 1.1.a, as used in PHP-Nuke, allows remote attackers to inject arbitrary web script or HTML via the eid parameter.

CVE-2004-2020 [MEDIUM] CVE-2004-2020: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attacke Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archive module, (4) mode, order, and thold parameters in the Surve

CVE-2004-2296 [MEDIUM] CVE-2004-2296: The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows sy The preview_review function in the Reviews module in PHP-Nuke 6.0 to 7.3, when running on Windows systems, allows remote attackers to obtain sensitive information via an invalid date parameter, which generates an error message.

CVE-2004-2019 [MEDIUM] CVE-2004-2019: The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive informat The WebLinks module in Php-Nuke 6.x through 7.3 allows remote attackers to obtain sensitive information via an invalid show parameter, which displays the full path in a PHP error message.

CVE-2004-1912 [MEDIUM] CVE-2004-1912: The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar_center.php The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendar_center.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an error message.