CVE-2007-0309: SQL Injection
SQL injection vulnerability in blocks/block-OldArticles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when registerglobals is enabled and magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0309?
CVE-2007-0309 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2007-0309?
To fix CVE-2007-0309, disable register_globals and enable magic_quotes_gpc within the PHP configuration if possible, or upgrade to a secure version of PHP-Nuke beyond 7.9.
What software is affected by CVE-2007-0309?
CVE-2007-0309 affects PHP-Nuke versions 7.9 and earlier.
What type of attack is associated with CVE-2007-0309?
CVE-2007-0309 is associated with SQL injection attacks, allowing unauthorized SQL command execution.
Can CVE-2007-0309 be exploited if register_globals is off?
No, CVE-2007-0309 can only be exploited if register_globals is enabled and magic_quotes_gpc is disabled.