Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the wp-pagenavi domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6114
Multiple Vulnerabilities in NukeCalendar - exploit.company
header-logo
Suggest Exploit
vendor:
NukeCalendar
by:
Unknown
7.5
CVSS
HIGH
Path Disclosure, SQL Injection, Cross-Site Scripting
200, 89, 79
CWE
Product Name: NukeCalendar
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: No
Related CWE:
CPE: a:php-nuke:nukecalendar
Metasploit:
Other Scripts:
Platforms Tested: PHP-Nuke
Unknown

Multiple Vulnerabilities in NukeCalendar

NukeCalendar, a third-party calendar module for PHP-Nuke, is vulnerable to multiple issues including path disclosure, SQL injection, and cross-site scripting. These vulnerabilities can lead to the disclosure of sensitive information, compromise of user accounts and bulletin boards, and potential attacks against the database through SQL injection.

Mitigation:

To mitigate these vulnerabilities, it is recommended to update NukeCalendar to the latest version or consider using an alternative calendar module that does not have these vulnerabilities. Additionally, input validation and output encoding should be implemented to prevent SQL injection and cross-site scripting attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar.php

Navigation

Suggest Exploit

Services By CQR