CVE-2017-13669
CriticalSummary
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized queries on the database, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to upgrade to the latest version of NexusPHP and to validate and sanitize input data in the application.
Other vulnerabilities in NexusPHP 1.5.beta5.20120707
See all- CVE-2017-12838High
The CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack user authentication for specific requests, such as sending manas or adding administrators.
- CVE-2017-14512Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an editforum action. This is a different vulnerability than CVE-2017-12981.
- CVE-2017-14076Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
- CVE-2017-14069Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
- CVE-2017-12679Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
- CVE-2017-12981Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an addforum action.
- CVE-2017-12776Critical
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
- CVE-2017-12910Critical
CVE-2017-12910 is an SQL injection vulnerability in massmail.php in NexusPHP 1.5 that allows remote attackers to execute arbitrary SQL commands via the or parameter.
- CVE-2017-12909Critical
An SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
- CVE-2017-12908Critical
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
Original NVD description (English source)
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.