CVE-2004-1972 in Video Gallery Plugin
Summary
by MITRE
SQL injection vulnerability in modules.php in PHP-Nuke Video Gallery Module 0.1 Beta 5 allows remote attackers to execute arbitrary SQL code via the (1) clipid or (2) catid parameters in a viewclip, viewcat, or voteclip action.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/16/2025
The vulnerability identified as CVE-2004-1972 represents a critical SQL injection flaw within the PHP-Nuke Video Gallery Module version 0.1 Beta 5, specifically affecting the modules.php file. This vulnerability resides in the application's handling of user-supplied input parameters, creating a pathway for malicious actors to manipulate database queries through crafted input values. The flaw manifests when the application processes the clipid or catid parameters during viewclip, viewcat, or voteclip actions, which are common functions within the video gallery module's operational flow.
The technical exploitation of this vulnerability occurs through the improper sanitization of user input values passed to the database layer. When an attacker submits malicious SQL code through the clipid or catid parameters, the application fails to validate or escape these inputs before incorporating them into SQL query strings. This lack of input validation creates a direct conduit for attackers to inject arbitrary SQL commands, potentially allowing them to bypass authentication mechanisms, extract sensitive data, modify database contents, or even execute administrative operations within the affected system. The vulnerability maps to CWE-89, which specifically addresses SQL injection flaws in software applications where user-controllable data is directly included in SQL statements without proper sanitization or parameterization.
The operational impact of this vulnerability extends beyond simple data theft, as it provides attackers with potential access to the entire database backend of the PHP-Nuke installation. Attackers could leverage this weakness to retrieve user credentials, personal information, or other sensitive data stored within the database. Additionally, the vulnerability could enable attackers to modify or delete content, potentially compromising the integrity of the video gallery module and the broader web application. The attack surface is particularly concerning given that PHP-Nuke was widely deployed content management systems in 2004, meaning that a successful exploitation could affect numerous websites simultaneously. This vulnerability aligns with ATT&CK technique T1190, which describes the use of SQL injection to gain unauthorized access to databases and extract sensitive information.
The remediation approach for this vulnerability requires immediate implementation of proper input validation and parameterized queries. System administrators should ensure that all user-supplied input parameters are thoroughly validated against expected data types and ranges before being processed. The recommended solution involves implementing prepared statements or parameterized queries that separate SQL code from user input, preventing malicious SQL fragments from being executed as part of the database command. Additionally, the application should employ proper output encoding when displaying database results to prevent potential cross-site scripting attacks that might occur in conjunction with this SQL injection vulnerability. Security patches should be applied immediately to upgrade to a non-vulnerable version of the PHP-Nuke Video Gallery Module, while access controls should be reviewed to minimize the impact of any potential exploitation. The vulnerability highlights the importance of input validation as a fundamental security control and demonstrates how seemingly minor oversights in code can create significant security risks.