CVE-2006-0907 - SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter

Back Back to CVE browser

HIGH

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter

Published Feb 28, 2006

7.5

HIGH

CVSS 2.0

EPSS 1.67%

Description

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

http://www.securityfocus.com/archive/1/426083/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.waraxe.us/advisory-47.html
x_refsource_MISCExploitVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-0911
Advisory

Link	Providers	Tags
http://www.securityfocus.com/archive/1/426083/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.waraxe.us/advisory-47.html		x_refsource_MISCExploitVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-0911		Advisory