Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PHP-Nuke Journal module lets attackers run database commands

CVE-2006-5720 · published 20 years ago
Summary

The Journal feature in PHP-Nuke versions up to 7.9 lets anyone send specially crafted data to the search page and cause the system to run unintended database commands. This could let an attacker view, change, or delete information stored in the website's database. Apply the available update or patch for PHP-Nuke, or remove/disable the Journal module until you can upgrade.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
francisco_burzi php-nuke <= 7.9
7.0
7.1
7.2
7.3
7.4
7.5
7.6
7.7
7.8
cpe:2.3:a:francisco_burzi:php-nuke:*:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat...
SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Timeline
Published4 Nov 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-5720 · NVD
Track software like this
Free during beta