Francisco Burzi Php-Nuke vulnerabilities

CVE-2001-1025 [CRITICAL] CVE-2001-1025: PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" v PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do not already define the prefix variable (e.g., by including mainfile.php), such as article.php.

CVE-2004-1830 [MEDIUM] CVE-2004-1830: error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive informat error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) newlang, or (3) lang parameter, which leaks the pathname in a PHP error message.

CVE-2001-1032 [HIGH] CVE-2001-1032: admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload op admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload operations, which allows remote attackers to copy and upload arbitrary files and read the PHP-Nuke configuration file by directly calling admin.php with an upload parameter and specifying the file to copy.

CVE-2004-0737 [HIGH] CVE-2004-0737: Multiple cross-site scripting vulnerabilities in index.php in the Search module for Php-Nuke allows Multiple cross-site scripting vulnerabilities in index.php in the Search module for Php-Nuke allows remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) max, (3) sel1, (4) sel2, (5) sel3, (6) sel4, (7) sel5, (8) match, (9) mod1, (10) mod2, or (11) mod3 parameters.

CVE-2001-0292 [HIGH] CVE-2001-0292: PHP-Nuke 4.4.1a allows remote attackers to modify a user's email address and obtain the password by PHP-Nuke 4.4.1a allows remote attackers to modify a user's email address and obtain the password by guessing the user id (UID) and calling user.php with the saveuser operator.

CVE-2005-3016 [CRITICAL] CVE-2005-3016: Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown Multiple unspecified vulnerabilities in the WYSIWYG editor in PHP-Nuke before 7.9 Final have unknown impact and attack vectors.

CVE-2001-0321 [MEDIUM] CVE-2001-0321: opendir.php script in PHP-Nuke allows remote attackers to read arbitrary files by specifying the fil opendir.php script in PHP-Nuke allows remote attackers to read arbitrary files by specifying the filename as an argument to the requesturl parameter.

CVE-2004-2354 [MEDIUM] CVE-2004-2354: SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers SQL injection vulnerability in 4nGuestbook 0.92 for PHP-Nuke 6.5 through 6.9 allows remote attackers to modify SQL statements via the entry parameter to modules.php, which can also facilitate cross-site scripting (XSS) attacks when MySQL errors are triggered.

CVE-2001-0854 [MEDIUM] CVE-2001-0854: PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager. PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user.

CVE-2005-0996 [MEDIUM] CVE-2005-0996: Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attacke Multiple SQL injection vulnerabilities in the Downloads module for PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the email or url parameters in the Add function, (2) the min parameter in the viewsdownload function, or (3) the min parameter in the search function.

CVE-2004-0731 [MEDIUM] CVE-2004-0731: Cross-site scripting (XSS) vulnerability in index.php in the Search module for Php-Nuke allows remot Cross-site scripting (XSS) vulnerability in index.php in the Search module for Php-Nuke allows remote attackers to inject arbitrary script as other users via the input field.

CVE-2005-1180 [MEDIUM] CVE-2005-1180: HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers HTTP Response Splitting vulnerability in the Surveys module in PHP-Nuke 7.6 allows remote attackers to spoof web content and poison web caches via hex-encoded CRLF ("%0d%0a") sequences in the forwarder parameter.

CVE-2007-5032 [MEDIUM] CWE-352 CVE-2007-5032: Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remo Cross-site request forgery (CSRF) vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified add_name and add_radminsuper parameters.

CVE-2004-2020 [MEDIUM] CVE-2004-2020: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attacke Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month_1 parameters in the Stories_Archive module, (4) mode, order, and thold parameters in the Surve

CVE-2004-1999 [MEDIUM] CVE-2004-1999: Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php.

CVE-2005-0434 [MEDIUM] CVE-2005-0434: Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 7.5 allow remote attackers to inject arbitrary HTML or web script via (1) the newdownloadshowdays parameter in a NewDownloads operation or (2) the newlinkshowdays parameter in a NewLinks operation.

CVE-2003-1547 [MEDIUM] CWE-79 CVE-2003-1547: Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke Cross-site scripting (XSS) vulnerability in block-Forums.php in the Splatt Forum module for PHP-Nuke 6.x allows remote attackers to inject arbitrary web script or HTML via the subject parameter.

CVE-2003-0279 [LOW] CVE-2003-0279: Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 5.x through 6.5 allows r Multiple SQL injection vulnerabilities in the Web_Links module for PHP-Nuke 5.x through 6.5 allows remote attackers to steal sensitive information via numeric fields, as demonstrated using (1) the viewlink function and cid parameter, or (2) index.php.

CVE-2004-1840 [MEDIUM] CVE-2004-1840: Multiple cross-site scripting (XSS) vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows re Multiple cross-site scripting (XSS) vulnerabilities in MS Analysis module 2.0 for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the (1) screen parameter to modules.php, (2) module_name parameter to title.php, (3) sortby parameter to modules.php, or (4) overview parameter to modules.php.

CVE-2006-1846 [MEDIUM] CVE-2006-1846: Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows rem Cross-site scripting (XSS) vulnerability in the Your_Account module in PHP-Nuke 7.8 might allows remote attackers to inject arbitrary HTML and web script via the ublock parameter, which is saved in the user's personal menu. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. In addition, it is unc