PT-2001-2020 · Php · Php-Nuke

Publicado 2001-11-22 · Atualizado 2016-10-18 · CVE-2001-0854

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 5.2

Description The issue allows remote attackers to copy and delete arbitrary files. This is achieved by calling case.filemanager.php with admin.php as an argument, which manipulates the $PHP SELF variable. As a result, it appears that case.filemanager.php is being called by admin.php instead of the user.

Recommendations For PHP-Nuke version 5.2, consider restricting access to the case.filemanager.php file until a proper fix is available. Additionally, review the configuration and permissions of the $PHP SELF variable to prevent manipulation.

Correção

Identificadores relacionados

CVE-2001-0854

Produtos afetados

Php-Nuke

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0854 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=100525739116093&w=2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0854 · Nota
• http://securityfocus.com/bid/3510 · Nota
• http://iss.net/security_center/static/7478.php · Nota