header-logo
Suggest Exploit
vendor:
NukeCalendar
by:
Unknown
5.5
CVSS
MEDIUM
Path Disclosure, SQL Injection, Cross-Site Scripting
200, 89, 79
CWE
Product Name: NukeCalendar
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE: a:php-nuke:nukecalendar
Metasploit:
Other Scripts:
Platforms Tested:
Unknown

Multiple vulnerabilities in NukeCalendar module for PHP-Nuke

The NukeCalendar module for PHP-Nuke is prone to multiple vulnerabilities including path disclosure, SQL injection, and cross-site scripting. These vulnerabilities could result in the disclosure of sensitive information, compromise of user accounts or bulletin boards, and possible attacks against the database implementation itself through SQL injection.

Mitigation:

Apply the latest security patches and updates for the NukeCalendar module. Use proper input validation and sanitization techniques to prevent SQL injection and cross-site scripting attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10082/info

NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.

These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection. 

http://www.example.com/nuke71/modules.php?op=modload&name=Kalender&file=index&type=view&eid=foobar

Navigation

Suggest Exploit

Services By CQR