header-logo
Suggest Exploit
vendor:
NukeCalendar
by:
Not mentioned
5.5
CVSS
MEDIUM
Path Disclosure, SQL Injection, Cross-site Scripting
200, 89
CWE
Product Name: NukeCalendar
Affected Version From: Not mentioned
Affected Version To: Not mentioned
Patch Exists: NO
Related CWE: Not mentioned
CPE: Not mentioned
Metasploit:
Other Scripts:
Platforms Tested: Not mentioned
2004

NukeCalendar Multiple Vulnerabilities

NukeCalendar, a third-party calendar module for PHP-Nuke, is vulnerable to multiple security issues. These include path disclosure, SQL injection, and cross-site scripting. These vulnerabilities can lead to the disclosure of sensitive information, compromise of user accounts, compromise of the bulletin board, and potential attacks against the database through SQL injection.

Mitigation:

The vendor has not provided a patch for these vulnerabilities. Users are advised to disable or remove the NukeCalendar module until a fix is available.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar1.php

Navigation

Suggest Exploit

Services By CQR