CVE-2017-12981
CriticalSummary
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an addforum action.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the database and exposure of sensitive information.
Recommendation
It is recommended to upgrade to the latest version of NexusPHP and to validate and sanitize input data in the application.
Other vulnerabilities in NexusPHP 1.5.beta5.20120707
See all- CVE-2017-12838High
The CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack user authentication for specific requests, such as sending manas or adding administrators.
- CVE-2017-14512Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an editforum action. This is a different vulnerability than CVE-2017-12981.
- CVE-2017-14076Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
- CVE-2017-14069Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
- CVE-2017-13669Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
- CVE-2017-12679Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
- CVE-2017-12776Critical
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
- CVE-2017-12910Critical
CVE-2017-12910 is an SQL injection vulnerability in massmail.php in NexusPHP 1.5 that allows remote attackers to execute arbitrary SQL commands via the or parameter.
- CVE-2017-12909Critical
An SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
- CVE-2017-12908Critical
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
Original NVD description (English source)
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.