This host is running PHP-Nuke and is prone to SQL Injection vulnerability.

Successful exploitation will let the attacker cause SQL Injection attack, gain sensitive information about the database used by the web application or can execute arbitrary code inside the context of the web application. Impact Level: Application

Upgrade to version or later http://phpnuke-downloads.com/phpnuke.html

The flaw is generated because the user supplied data passed into 'referer' header element when requesting the '/main/tracking/userLog.php' is not properly sanitized before it is used in an SQL query.

PHP-Nuke version 8.0 and prior on all platforms.

• http://gsasec.blogspot.com/2009/05/php-nuke-v80-referer-sql-injection.html
• http://www.securityfocus.com/archive/1/503845

---

Updated on 2015-03-25