CVE-2004-2000
Php-Nuke 6.x-7.2 - SQL Injection via Orderby or Sid Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2004-2000. PoCs published by S@BUN.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in the Downloads module for PHP-Nuke. It leverages unsanitized user input in the 'sid' parameter to perform a UNION-based SQL injection, extracting sensitive data such as admin credentials from the 'nuke_authors' table.
Description
SQL injection vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to execute arbitrary SQL via the (1) orderby or (2) sid parameters to modules.php.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in the Downloads module for PHP-Nuke. It leverages unsanitized user input in the 'sid' parameter to perform a UNION-based SQL injection, extracting sensitive data such as admin credentials from the 'nuke_authors' table.