Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Vista
BugTraq
Name:
Email:
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Subject:
Message:
 
PHP-Nuke SQL Injection Oct 08 2003 03:37PM
mod (rottyfig12 hotmail com)


Version: PHP-Nuke 6.6

Language: PHP

Web site: phpnuke.org

Status: Vendor has been notified

There's an SQL injection hole in modules.php.

http://phpnuke.org/modules.php?name=Downloads&d_op=viewdownload&cid=59%2
0or%20cid=2

This is from not filtering 'cid', it should be checked that it is...

[ more ]  




 

Privacy Statement
Copyright 2008, SecurityFocus