CVE-2017-14512
CriticalSummary
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an editforum action. This is a different vulnerability than CVE-2017-12981.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the database and exposure of sensitive information. Organizations should be aware of the risks associated with inadequate application security.
Recommendation
It is recommended to upgrade to the latest version of NexusPHP and implement proper input filtering and validation to minimize the risk of SQL Injection attacks.
Other vulnerabilities in NexusPHP 1.5.beta5.20120707
See all- CVE-2017-12838High
The CSRF vulnerability in NexusPHP 1.5 allows remote attackers to hijack user authentication for specific requests, such as sending manas or adding administrators.
- CVE-2017-14076Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
- CVE-2017-14069Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
- CVE-2017-13669Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
- CVE-2017-12679Critical
SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
- CVE-2017-12981Critical
NexusPHP version 1.5.beta5.20120707 has an SQL Injection vulnerability in forummanage.php via the sort parameter in an addforum action.
- CVE-2017-12776Critical
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
- CVE-2017-12910Critical
CVE-2017-12910 is an SQL injection vulnerability in massmail.php in NexusPHP 1.5 that allows remote attackers to execute arbitrary SQL commands via the or parameter.
- CVE-2017-12909Critical
An SQL injection vulnerability in modtask.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
- CVE-2017-12908Critical
SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the conusr parameter.
Original NVD description (English source)
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981.