CVE-2004-1949

CVE-2004-1949 describes a critical SQL injection vulnerability affecting PostNuke 7.2.6 and earlier versions. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands through the 'sif' parameter in the Comments module or the 'timezoneoffset' parameter in the Your_Account module. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to unauthorized data disclosure, modification, or denial of service. While there is no known active exploitation or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.