CVE-2004-1929

CVE-2004-1929 describes a SQL injection vulnerability within the bblogin function of functions.php in PHP-Nuke versions 6.x through 7.2. This flaw allows remote attackers to bypass authentication and gain unauthorized access by injecting base64-encoded SQL code into the 'user' parameter. The vulnerability carries a CVSS score of 7.5, indicating high severity. It is easily exploitable over the network with low attack complexity and no authentication required, potentially leading to partial compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation in the wild (KEV list), exploit code is publicly available via ExploitDB. Despite this, there is minimal community discussion or media coverage surrounding this particular CVE.