EIP-2026-110840

PRE-CVE

PHP-Nuke 5.6/6.x News Module - 'article.php' SQL Injection

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-110840. PoCs published by frog.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in PHPNuke's News module, allowing an attacker to manipulate database queries to escalate privileges or change user passwords. The attack leverages improper input validation in the article.php file when magic_quotes_gpc is disabled.

Description

PHP-Nuke 5.6/6.x News Module - 'article.php' SQL Injection

Exploits (1)

exploitdb WORKING POC VERIFIED
by frog · textwebappsphp
https://www.exploit-db.com/exploits/22413

This exploit demonstrates a SQL injection vulnerability in PHPNuke's News module, allowing an attacker to manipulate database queries to escalate privileges or change user passwords. The attack leverages improper input validation in the article.php file when magic_quotes_gpc is disabled.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: PHPNuke (News module)
No auth needed
Prerequisites: magic_quotes_gpc=OFF · PHPNuke installation with News module
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026