Sign-up

ID

VAR-200612-0745


CVE

CVE-2006-6234


TITLE

PHP-Nuke of Content In module SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2006-001670

DESCRIPTION

Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action. (1) list_pages_categories In action cid Parameters (2) showpage action In action pid Parameters. PHP-Nuke is prone to an sql-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. PHP-Nuke is prone to a sql-injection vulnerability. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database

Trust: 2.25

sources: NVD: CVE-2006-6234 // JVNDB: JVNDB-2006-001670 // BID: 77912 // BID: 87224 // VULHUB: VHN-22342

AFFECTED PRODUCTS

vendor:francisco burzimodel:php-nukescope:eqversion:6.0

Trust: 2.4

vendor:franciscomodel:burzi php-nukescope:eqversion:6.0

Trust: 0.6

sources: BID: 77912 // BID: 87224 // JVNDB: JVNDB-2006-001670 // CNNVD: CNNVD-200612-014 // NVD: CVE-2006-6234

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-6234
value: HIGH

Trust: 1.0

NVD: CVE-2006-6234
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200612-014
value: HIGH

Trust: 0.6

VULHUB: VHN-22342
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2006-6234
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-22342
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-22342 // JVNDB: JVNDB-2006-001670 // CNNVD: CNNVD-200612-014 // NVD: CVE-2006-6234

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-6234

THREAT TYPE

network

Trust: 0.6

sources: BID: 77912 // BID: 87224

TYPE

Input Validation Error

Trust: 0.6

sources: BID: 77912 // BID: 87224

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2006-001670

PATCH
title:Top Pageurl:http://phpnuke.org/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2006-001670

EXTERNAL IDS
db:NVDid:CVE-2006-6234
Trust: 3.1
db:SREASONid:1953
Trust: 2.0
db:JVNDBid:JVNDB-2006-001670
Trust: 0.8
db:XFid:27501
Trust: 0.6
db:BUGTRAQid:20060617 MODULE'S NAME  CONTENT<
Trust: 0.6
db:VIMid:20061201 OLD PHP-NUKE/POSTNUKE SQL INJECTION ISSUES - CLARIFICATION
Trust: 0.6
db:CNNVDid:CNNVD-200612-014
Trust: 0.6
db:BIDid:87224
Trust: 0.4
db:BIDid:77912
Trust: 0.4
db:VULHUBid:VHN-22342
Trust: 0.1
sources:
            
            
            VULHUB: VHN-22342 // 
            
            
            
            BID: 77912 // 
            
            
            
            BID: 87224 // 
            
            
            
            JVNDB: JVNDB-2006-001670 // 
            
            
            
            CNNVD: CNNVD-200612-014 // 
            
            
            
            NVD: CVE-2006-6234

REFERENCES
url:http://www.attrition.org/pipermail/vim/2006-december/001157.html
Trust: 2.3
url:http://securityreason.com/securityalert/1953
Trust: 2.0
url:http://www.securityfocus.com/archive/1/archive/1/437835/100/200/threaded
Trust: 1.2
url:http://www.securityfocus.com/archive/1/437835/100/200/threaded
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/27501
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-6234
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-6234
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/27501
Trust: 0.6
sources:
            
            
            VULHUB: VHN-22342 // 
            
            
            
            BID: 77912 // 
            
            
            
            BID: 87224 // 
            
            
            
            JVNDB: JVNDB-2006-001670 // 
            
            
            
            CNNVD: CNNVD-200612-014 // 
            
            
            
            NVD: CVE-2006-6234

CREDITS
Unknown
Trust: 0.6
sources:
            
            
            BID: 77912 // 
            
            
            
            BID: 87224

SOURCES
db:VULHUBid:VHN-22342
db:BIDid:77912
db:BIDid:87224
db:JVNDBid:JVNDB-2006-001670
db:CNNVDid:CNNVD-200612-014
db:NVDid:CVE-2006-6234

LAST UPDATE DATE
2024-08-14T13:39:41.079000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-22342date:2018-10-17T00:00:00
db:BIDid:77912date:2006-12-02T00:00:00
db:BIDid:87224date:2006-12-02T00:00:00
db:JVNDBid:JVNDB-2006-001670date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200612-014date:2007-08-07T00:00:00
db:NVDid:CVE-2006-6234date:2018-10-17T21:47:20.297

SOURCES RELEASE DATE
db:VULHUBid:VHN-22342date:2006-12-02T00:00:00
db:BIDid:77912date:2006-12-02T00:00:00
db:BIDid:87224date:2006-12-02T00:00:00
db:JVNDBid:JVNDB-2006-001670date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200612-014date:2006-12-02T00:00:00
db:NVDid:CVE-2006-6234date:2006-12-02T11:28:00