CVE-2006-6200

Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.

Affected Software

Name	Vendor	Start Version	End Version
Php-nuke	Francisco_burzi	7.0 (including)	7.0 (including)
Php-nuke	Francisco_burzi	7.0_final (including)	7.0_final (including)
Php-nuke	Francisco_burzi	7.1 (including)	7.1 (including)
Php-nuke	Francisco_burzi	7.2 (including)	7.2 (including)
Php-nuke	Francisco_burzi	7.3 (including)	7.3 (including)
Php-nuke	Francisco_burzi	7.4 (including)	7.4 (including)
Php-nuke	Francisco_burzi	7.5 (including)	7.5 (including)
Php-nuke	Francisco_burzi	7.6 (including)	7.6 (including)
Php-nuke	Francisco_burzi	7.7 (including)	7.7 (including)
Php-nuke	Francisco_burzi	7.8 (including)	7.8 (including)
Php-nuke	Francisco_burzi	7.8_patched_3.2 (including)	7.8_patched_3.2 (including)
Php-nuke	Francisco_burzi	7.9 (including)	7.9 (including)

NVD	https://nvd.nist.gov/vuln/detail/CVE-2006-6200
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References