CVE-2021-30177
CRITICALPHP-Nuke 8.3.3 - SQL Injection and Remote Code Execution via User Registration
Title source: llmDescription
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47
Scores
CVSS v3
9.8
EPSS
0.0236
EPSS Percentile
81.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
phpnuke/php-nuke
8.3.3
Published
Apr 07, 2021
Tracked Since
Feb 18, 2026