CVE-2003-1210

CVE-2003-1210 describes multiple SQL injection vulnerabilities in the Downloads module of PHP-Nuke versions 5.x through 6.5. Attackers can exploit these flaws by manipulating the 'lid' parameter in the getit function or the 'min' parameter in the search function to execute arbitrary SQL commands. This vulnerability carries a CVSS score of 7.5 (High), indicating a critical risk due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog, exploit code for this vulnerability is publicly available on ExploitDB. The CVE has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers, but there is no evidence of active exploitation in the wild.