SQL Injection Vulnerability in PHP-Nuke 8.3.3 User Registration Section Leading to Remote Code Execution

CVE-2021-30177 · CRITICAL Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.

Learn more about our Cis Benchmark Audit For Microsoft Sql Server.