CVE-2004-2295: SQL Injection
Published Dec 31, 2004
·Updated
SQL injection vulnerability in the Reviews module in PHP-Nuke 6.0 to 7.3 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Affected Software
30 affected components
Francisco Burzi PHP-Nuke=6.0
Francisco Burzi PHP-Nuke=6.5
Francisco Burzi PHP-Nuke=6.5_beta1
Francisco Burzi PHP-Nuke=6.5_final
Francisco Burzi PHP-Nuke=6.5_rc1
Francisco Burzi PHP-Nuke=6.5_rc2
Francisco Burzi PHP-Nuke=6.5_rc3
Francisco Burzi PHP-Nuke=6.6
Francisco Burzi PHP-Nuke=6.7
Francisco Burzi PHP-Nuke=6.9
Francisco Burzi PHP-Nuke=7.0
Francisco Burzi PHP-Nuke=7.0_final
Francisco Burzi PHP-Nuke=7.1
Francisco Burzi PHP-Nuke=7.2
Francisco Burzi PHP-Nuke=7.3
Francisco Burzi PHP-Nuke=6.5_beta1
Francisco Burzi PHP-Nuke=6.5
Francisco Burzi PHP-Nuke=7.0
Francisco Burzi PHP-Nuke=7.2
Francisco Burzi PHP-Nuke=7.0_final
Francisco Burzi PHP-Nuke=6.5_rc2
Francisco Burzi PHP-Nuke=7.3
Francisco Burzi PHP-Nuke=6.5_rc3
Francisco Burzi PHP-Nuke=6.0
Francisco Burzi PHP-Nuke=6.5_final
Francisco Burzi PHP-Nuke=6.7
Francisco Burzi PHP-Nuke=6.6
Francisco Burzi PHP-Nuke=6.9
Francisco Burzi PHP-Nuke=7.1
Francisco Burzi PHP-Nuke=6.5_rc1
Event History
Dec 31, 2004
CVE Published
05:00 AM
Aug 4, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2295?
CVE-2004-2295 is considered a high-severity vulnerability due to the potential for remote attackers to execute arbitrary SQL commands.
2
How do I fix CVE-2004-2295?
To fix CVE-2004-2295, you should update PHP-Nuke to a version that is not affected by this SQL injection vulnerability.
3
Which versions of PHP-Nuke are affected by CVE-2004-2295?
CVE-2004-2295 affects PHP-Nuke versions from 6.0 to 7.3.
4
What type of vulnerability is CVE-2004-2295?
CVE-2004-2295 is an SQL injection vulnerability that allows remote attackers to manipulate database queries.
5
Can CVE-2004-2295 be exploited without authentication?
Yes, CVE-2004-2295 can be exploited by remote attackers without requiring authentication.