CVE-2004-2000: SQL Injection
Published May 5, 2004
·Updated
SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php.
Affected Software
28 affected components
Francisco Burzi PHP-Nuke=6.0
Francisco Burzi PHP-Nuke=6.5
Francisco Burzi PHP-Nuke=6.5_beta1
Francisco Burzi PHP-Nuke=6.5_final
Francisco Burzi PHP-Nuke=6.5_rc1
Francisco Burzi PHP-Nuke=6.5_rc2
Francisco Burzi PHP-Nuke=6.5_rc3
Francisco Burzi PHP-Nuke=6.6
Francisco Burzi PHP-Nuke=6.7
Francisco Burzi PHP-Nuke=6.9
Francisco Burzi PHP-Nuke=7.0
Francisco Burzi PHP-Nuke=7.0_final
Francisco Burzi PHP-Nuke=7.1
Francisco Burzi PHP-Nuke=7.2
Francisco Burzi PHP-Nuke=6.5_beta1
Francisco Burzi PHP-Nuke=6.5
Francisco Burzi PHP-Nuke=7.0
Francisco Burzi PHP-Nuke=7.2
Francisco Burzi PHP-Nuke=7.0_final
Francisco Burzi PHP-Nuke=6.5_rc2
Francisco Burzi PHP-Nuke=6.5_rc3
Francisco Burzi PHP-Nuke=6.0
Francisco Burzi PHP-Nuke=6.5_final
Francisco Burzi PHP-Nuke=6.7
Francisco Burzi PHP-Nuke=6.6
Francisco Burzi PHP-Nuke=6.9
Francisco Burzi PHP-Nuke=7.1
Francisco Burzi PHP-Nuke=6.5_rc1
Event History
May 5, 2004
CVE Published
04:00 AM
May 10, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2000?
The severity of CVE-2004-2000 is considered medium due to its potential for SQL injection attacks.
2
How do I fix CVE-2004-2000?
To fix CVE-2004-2000, you should upgrade to a patched version of PHP-Nuke that addresses the SQL injection vulnerability.
3
Which versions of PHP-Nuke are affected by CVE-2004-2000?
CVE-2004-2000 affects PHP-Nuke versions 6.x through 7.2 including 6.0, 6.5, 7.0, and 7.2.
4
What kind of attacks can be executed through CVE-2004-2000?
Attackers can execute arbitrary SQL commands through the orderby or sid parameters, leading to unauthorized data access.
5
Is CVE-2004-2000 a common vulnerability?
Yes, CVE-2004-2000 is a known vulnerability that has been commonly exploited in versions of PHP-Nuke between 6.x and 7.2.