CVE Vulnerability

CVE-2021-30177

There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47 Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:phpnuke:php-nuke:8.3.3:*:*:*:*:*:*:*
Information

Published : 2021-04-07 11:15

Updated : 2021-04-13 09:38

NVD link : CVE-2021-30177

Mitre link : CVE-2021-30177

Products Affected

Php-nuke

Phpnuke

CWE
CWE-89