Unscored CVE-2006-0907 EUVD-2006-0911GHSA-vc7f-952f-fcmv

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (…

Published Feb 28, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

SQL injection vulnerability in PHP-Nuke before 7.8 Patched 3.2 allows remote attackers to execute arbitrary SQL commands via encoded /%2a (/*) sequences in the query string, which bypasses regular expressions that are intended to protect against SQL injection, as demonstrated via the kala parameter.

References

20060225 [waraxe-2006-SA#047] - Evading sql-injection filters in phpNuke 7.8 mailing-list
http://www.waraxe.us/advisory-47.html