CVE-2004-2751 SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
MediumCVSS 6.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the members_list module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postnuke software foundation postnuke | = 0.722 | No fix listed |
| postnuke software foundation postnuke | = 0.723 | No fix listed |
| postnuke software foundation postnuke | = 0.726 | No fix listed |
References
- 20030309 Postnuke v 0.723 SQL injection and directory traversing exploit mailing-list
- community.postnuke.com patch
- lists.postnuke.com
- 1008629 vdb-entry
- 20040102 PostNuke Issues (0.726 && Possibly Older) mailing-list patch
- www.gulftech.org
- 3334 vdb-entry
- postnuke-memberslist-sql-injection(11500) vdb-entry