VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2004· Updated Apr 16, 2026

CVE-2004-1530

CVE-2004-1530

Description

SQL injection in Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via eid or cid parameters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SQL injection in Event Calendar module 2.13 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via eid or cid parameters.

Vulnerability

The Event Calendar module version 2.13 for PHP-Nuke contains a SQL injection vulnerability in the handling of the eid and cid parameters. The module fails to sanitize user-supplied input before incorporating it into SQL queries, allowing an attacker to inject arbitrary SQL commands. This affects all installations using the vulnerable version [1][2].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted HTTP request to the Event Calendar module with malicious SQL code embedded in the eid or cid parameters. No special privileges or user interaction are required; the attacker only needs network access to the vulnerable PHP-Nuke site [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized disclosure of sensitive data (e.g., user credentials, personal information), modification or deletion of database content, and potentially full compromise of the application and server [1][2].

Mitigation

No official patch was released for this vulnerability. The Event Calendar module is no longer maintained, and users are advised to remove or replace the module with a secure alternative. As of the publication date (2004-12-31), no workaround is available [1][2].

References
  1. '[waraxe-2004-SA#038 - Multiple vulnerabilities in Event Calendar'
  2. 2004-SA#038] - Multiple vulnerabilities in Event Calendar module for PhpNuke

AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The `$eid` and `$cid` variables are used directly in SQL queries without being enclosed in single quotes, enabling SQL injection."

Attack vector

An attacker sends a crafted HTTP GET request to the PHP-Nuke Calendar module, supplying malicious SQL in the `eid` or `cid` parameters [ref_id=1][ref_id=2]. Because these variables are not enclosed in single quotes in the SQL query, the attacker can inject arbitrary SQL commands. The advisory provides a proof-of-concept URL that uses a UNION ALL SELECT payload to extract admin credentials from the `nuke_authors` table [ref_id=1][ref_id=2].

Affected code

The advisory identifies that SQL queries in the Event Calendar module use the variables `$eid` and `$cid` without surrounding them with single quotes [ref_id=1][ref_id=2]. The vulnerable code resides in the module's PHP files that handle the `eid` and `cid` parameters, though the advisory does not name specific function or file paths beyond the module name.

What the fix does

No official patch was ever released by the vendor; the advisory states that after being contacted in September 2004 the developer stopped responding and the downloadable version remained unpatched [ref_id=1][ref_id=2]. The advisory directs users to community forums for patching help [ref_id=1][ref_id=2]. A proper fix would involve sanitizing or quoting the `$eid` and `$cid` variables before they are used in SQL queries.

Preconditions

  • configThe PHP-Nuke Event Calendar module version 2.13 must be installed and accessible.
  • networkThe attacker must be able to send HTTP requests to the server hosting the vulnerable module.
  • authNo authentication is required; the vulnerable parameters are exposed to unauthenticated users.

Reproduction

1. Ensure the Event Calendar module 2.13 is installed on a PHP-Nuke instance. 2. Send a request to the following URL, replacing `localhost/nuke73` with the target base path: `http://localhost/nuke73/modules.php?name=Calendar&file=index&type=view&eid=-99%20UNION%20ALL%20SELECT%201,1,aid,1,pwd,1,1,1,1,1,1,1,1,1,1%20FROM%20nuke_authors%20WHERE%20radminsuper=1` [ref_id=1][ref_id=2]. 3. Observe that the response includes admin usernames and password hashes from the `nuke_authors` table.

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.