Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PHP‑Nuke Current Issue module lets attackers run database commands

CVE-2008-6866 · published 17 years ago
Summary

The Current Issue component of PHP‑Nuke allows a remote user to send specially crafted requests that execute any SQL command in the website’s database through the id field. This could let an attacker view, change or delete data stored by the site. Install the latest security update for the module or upgrade to a newer PHP‑Nuke version that removes the flaw.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php-nuke current_issue_module All versions
cpe:2.3:a:php-nuke:current_issue_module:*:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in modules.php in the Current_Issue module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a summary action.
SQL injection vulnerability in modules.php in the Current_Issue module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a summary action.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published14 Jul 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-6866 · NVD
Track software like this
Free during beta