Signature Detail
Short Name |
HTTP:PHP:PHPNUKE:MODULES-DOS |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
HTTP |
Keywords |
PHP-Nuke modules.php SQL Injection DoS |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: PHP-Nuke modules.php SQL Injection DoS
This signature detects attempts to exploit a SQL injection vulnerability in the modules.php script that ships with PHPNuke. PHPNuke 6.0 and earlier are vulnerable. Attackers can produce a process that increases system load on the server, making it unusable until the process is killed.
Extended Description
A SQL injection vulnerability has been reported for PHP-Nuke 5.6. The vulnerability is due to insufficient sanitization of variables used to construct SQL queries in some scripts. It is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script. By injecting SQL code into variables, it may be possible for an attacker to corrupt database information.
Affected Products
- Francisco Burzi PHP-Nuke 5.6.0
References