header-logo
Suggest Exploit
vendor:
NukeCalendar
by:
Unknown
7.5
CVSS
HIGH
Path Disclosure, SQL Injection, Cross-Site Scripting
200, 89, 79
CWE
Product Name: NukeCalendar
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: No
Related CWE:
CPE: a:php-nuke:nukecalendar
Metasploit:
Other Scripts:
Platforms Tested: PHP-Nuke
Unknown

Multiple Vulnerabilities in NukeCalendar

NukeCalendar, a third-party calendar module for PHP-Nuke, is vulnerable to multiple issues including path disclosure, SQL injection, and cross-site scripting. These vulnerabilities can lead to the disclosure of sensitive information, compromise of user accounts and bulletin boards, and potential attacks against the database through SQL injection.

Mitigation:

To mitigate these vulnerabilities, it is recommended to update NukeCalendar to the latest version or consider using an alternative calendar module that does not have these vulnerabilities. Additionally, input validation and output encoding should be implemented to prevent SQL injection and cross-site scripting attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar.php

Navigation

Suggest Exploit

Services By CQR