CVE-2021-30177

There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpnuke:php-nuke:8.3.3:*:*:*:*:*:*:*

History

13 Apr 2021, 21:38

Type	Values Removed	Values Added
CWE		CWE-89
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.5 v3 : 9.8
References	~~(MISC) https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47 -~~	(MISC) https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47 - Exploit, Third Party Advisory
CPE		cpe:2.3:a:phpnuke:php-nuke:8.3.3:::::::*

07 Apr 2021, 11:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-04-07 11:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-30177

Mitre link : CVE-2021-30177

CVE.ORG link : CVE-2021-30177

JSON object : View

Products Affected

phpnuke

php-nuke

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2021-30177", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-04-07T11:15:12.293", "references": [{"url": "https://gist.github.com/stacksmasher007/41e946fc9a5a2f0b6950626cc9d43d47", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de inyecci\u00f3n SQL en PHP-Nuke versi\u00f3n 8.3.3, en la secci\u00f3n User Registration, que conlleva a una ejecuci\u00f3n de c\u00f3digo remota. Esto ocurre porque el estado de U.S. no est\u00e1 comprobado para tener dos letras y el campo OrderBy no est\u00e1 comprobado para ser uno de LASTNAME, CITY, o STATE"}], "lastModified": "2021-04-13T21:38:06.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpnuke:php-nuke:8.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8792184-8092-4443-B532-DA3D7139A942"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}