Details of VAR-200212-0099

ID

VAR-200212-0099

CVE

CVE-2002-2032

TITLE

PHP-Nuke SQL_Debug Debugging Information Disclosure Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200212-243

DESCRIPTION

sql_layer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sql_debug parameter to (1) index.php and (2) modules.php. PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. Access to the debugging feature is not restricted to administrators. This may be used by a remote attacker to disclose sensitive information about the database which may contribute to further attacks against the website running PHPNuke and the database. It is not known whether PostNuke is also affected by this issue

Trust: 1.26

sources: NVD: CVE-2002-2032 // BID: 3906 // VULHUB: VHN-6415

AFFECTED PRODUCTS

vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	4.4	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.1	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	4.4.1a	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.0	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.0.1	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	4.0	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	3.0	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	4.3	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	2.5	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	1.0	Trust: 1.6
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.4	Trust: 1.0
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.2a	Trust: 1.0
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.3.1	Trust: 1.0
vendor:	francisco burzi	model:	php-nuke	scope:	eq	version:	5.2	Trust: 1.0
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	5.4	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	5.3.1	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke a	scope:	eq	version:	5.2	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	5.2	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	5.1	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	5.0.1	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	5.0	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke a	scope:	eq	version:	4.4.1	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	4.4	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	4.3	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	4.0	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	3.0	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	2.5	Trust: 0.3
vendor:	francisco	model:	burzi php-nuke	scope:	eq	version:	1.0	Trust: 0.3

sources: BID: 3906 // CNNVD: CNNVD-200212-243 // NVD: CVE-2002-2032

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2002-2032
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-200212-243
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-6415
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2002-2032
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
VULHUB:	VHN-6415
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-6415 // CNNVD: CNNVD-200212-243 // NVD: CVE-2002-2032

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2002-2032

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200212-243

TYPE

Design Error

Trust: 0.9

sources: BID: 3906 // CNNVD: CNNVD-200212-243

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-6415

EXTERNAL IDS

db:	BID	id:	3906	Trust: 2.0
db:	NVD	id:	CVE-2002-2032	Trust: 1.7
db:	CNNVD	id:	CNNVD-200212-243	Trust: 0.7
db:	NSFOCUS	id:	2145	Trust: 0.6
db:	EXPLOIT-DB	id:	21233	Trust: 0.1
db:	SEEBUG	id:	SSVID-75068	Trust: 0.1
db:	VULHUB	id:	VHN-6415	Trust: 0.1

sources: VULHUB: VHN-6415 // BID: 3906 // CNNVD: CNNVD-200212-243 // NVD: CVE-2002-2032

REFERENCES

url:	http://www.securityfocus.com/bid/3906	Trust: 2.7
url:	http://www.securityfaq.com/unixfocus/5op041p6be.html	Trust: 2.7
url:	http://www.nsfocus.net/vulndb/2145	Trust: 0.6
url:	http://www.irannuke.com/	Trust: 0.3

sources: VULHUB: VHN-6415 // BID: 3906 // CNNVD: CNNVD-200212-243 // NVD: CVE-2002-2032

CREDITS

Cabezon Aurelien※ aurelien.cabezon@isecurelabs.com

Trust: 0.6

sources: CNNVD: CNNVD-200212-243

SOURCES

db:	VULHUB	id:	VHN-6415
db:	BID	id:	3906
db:	CNNVD	id:	CNNVD-200212-243
db:	NVD	id:	CVE-2002-2032

LAST UPDATE DATE

2024-11-22T22:51:33.647000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-6415	date:	2008-09-05T00:00:00
db:	BID	id:	3906	date:	2002-01-18T00:00:00
db:	CNNVD	id:	CNNVD-200212-243	date:	2005-10-20T00:00:00
db:	NVD	id:	CVE-2002-2032	date:	2024-11-20T23:42:42.697

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-6415	date:	2002-12-31T00:00:00
db:	BID	id:	3906	date:	2002-01-18T00:00:00
db:	CNNVD	id:	CNNVD-200212-243	date:	2002-01-18T00:00:00
db:	NVD	id:	CVE-2002-2032	date:	2002-12-31T05:00:00