CVE-2008-0461: SQL Injection
SQL injection vulnerability in index.php in the Search module in PHP-Nuke 8.0 FINAL and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the sid parameter in a comments action to modules.php. NOTE: some of these details are obtained from third party information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0461?
CVE-2008-0461 has a medium severity rating as it allows remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2008-0461?
To fix CVE-2008-0461, upgrade PHP-Nuke to a version later than 8.0 or ensure that magic_quotes_gpc is enabled.
What versions of PHP-Nuke are affected by CVE-2008-0461?
PHP-Nuke versions 8.0 FINAL and earlier are affected by CVE-2008-0461.
What type of vulnerability is CVE-2008-0461?
CVE-2008-0461 is an SQL injection vulnerability that allows attackers to manipulate SQL queries.
Is CVE-2008-0461 exploitable remotely?
Yes, CVE-2008-0461 can be exploited remotely if the conditions for executing SQL commands are met.