CVE-2002-2032: Medium severity Francisco Burzi PHP-Nuke vulnerability
sqllayer.php in PHP-Nuke 5.4 and earlier does not restrict access to debugging features, which allows remote attackers to gain SQL query information by setting the sqldebug parameter to (1) index.php and (2) modules.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the sql_debug debugging feature so it cannot be enabled by remote users. Ensure index.php and modules.php do not honor a sql_debug=1 parameter (remove/ignore the parameter) or modify sql_layer.php to only permit debug output for authenticated administrators.
sql_layer.php (PHP-Nuke) sql_debug = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2032?
CVE-2002-2032 is considered a medium severity vulnerability that could allow attackers to access sensitive SQL query information.
How do I fix CVE-2002-2032?
To fix CVE-2002-2032, upgrade to a later version of PHP-Nuke where access to debugging features is properly restricted.
What impact does CVE-2002-2032 have on PHP-Nuke?
CVE-2002-2032 allows remote attackers to gain access to SQL command output which could lead to data exposure or database manipulation.
Which versions of PHP-Nuke are affected by CVE-2002-2032?
CVE-2002-2032 affects PHP-Nuke versions 5.4 and earlier.
Is CVE-2002-2032 easy to exploit?
Yes, CVE-2002-2032 can be easily exploited by altering the sql_debug parameter in the URL.