CVE-2005-0997: SQL Injection
Multiple SQL injection vulnerabilities in the WebLinks module for PHP-Nuke 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the email or url parameters in the Add function, (2) the url parameter in the modifylinkrequestS function, (3) the orderby or min parameters in the viewlink function, (4) the orderby, min, or show parameters in the search function, or (5) the ratenum parameter in the MostPopular function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-0997?
CVE-2005-0997 is classified as a critical severity vulnerability due to its potential for remote code execution via SQL injection.
How do I fix CVE-2005-0997?
To fix CVE-2005-0997, you should upgrade to a patched version of PHP-Nuke that addresses the SQL injection vulnerabilities.
Who is affected by CVE-2005-0997?
Any user of PHP-Nuke version 7.6 running the Web_Links module is at risk from CVE-2005-0997.
What are the common attack vectors for CVE-2005-0997?
Attackers can exploit CVE-2005-0997 through multiple parameters such as email, url, orderby, or min in specific functions.
Is there any workaround available for CVE-2005-0997?
While immediate upgrades are recommended, users can temporarily filter and sanitize input parameters to mitigate the risk of exploitation.