CVE-2002-1242

PHP-Nuke < 6.0 - Authenticated SQL Injection via Bio Argument

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2002-1242. PoCs published by kill9.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in PHP-Nuke 5.6 by manipulating the 'bio' parameter in a user account update request. The injected SQL modifies the user's password hash to a known value (md5(1)), allowing unauthorized access.

Description

SQL injection vulnerability in PHP-Nuke before 6.0 allows remote authenticated users to modify the database and gain privileges via the "bio" argument to modules.php.

Exploits (1)

exploitdb WORKING POC VERIFIED

by kill9 · textwebappsphp

https://www.exploit-db.com/exploits/21977

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in PHP-Nuke 5.6 by manipulating the 'bio' parameter in a user account update request. The injected SQL modifies the user's password hash to a known value (md5(1)), allowing unauthorized access.

Classification

Working Poc 90%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: PHP-Nuke 5.6

Auth required

Prerequisites: Valid user session · Access to the 'Your_Account' module

MITRE ATT&CK