Description
Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via (1) the cid parameter in a list_pages_categories action or (2) the pid parameter in a showpage action.
References
- 20060617 Module's Name Content<<--V1.0 SQL injection mailing-list
- 1953 third-party-advisory
- 20061201 Old PHP-Nuke/PostNuke SQL injection issues - clarification mailing-list
- phpnuke-module-sqlinjection(27501) vdb-entry