CVE-2006-6200: SQL Injection
Multiple SQL injection vulnerabilities in the (1) ratearticle and (2) ratecomplete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6200?
CVE-2006-6200 is considered a high-severity vulnerability due to its potential to allow execution of arbitrary SQL commands.
How do I fix CVE-2006-6200?
To fix CVE-2006-6200, upgrade to a patched version of PHP-Nuke where the SQL injection vulnerabilities have been resolved.
Which versions of PHP-Nuke are affected by CVE-2006-6200?
CVE-2006-6200 affects PHP-Nuke versions 7.9 and earlier.
What are the implications of exploiting CVE-2006-6200?
Exploiting CVE-2006-6200 can allow remote attackers to manipulate the database, potentially compromising sensitive information.
Is magic_quotes_gpc relevant to CVE-2006-6200?
Yes, CVE-2006-6200 affects systems when magic_quotes_gpc is disabled, increasing the risk of SQL injection.