PT-2001-2179 · Php · Php-Nuke

Publicado 2001-09-24 · Atualizado 2017-10-10 · CVE-2001-1032

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 5.2 and earlier, except 5.0RC1

Description The issue allows remote attackers to copy and upload arbitrary files and read the PHP-Nuke configuration file by directly calling the "admin.php" endpoint with an upload parameter and specifying the file to copy. This is due to the lack of login credential checks for upload operations in the affected versions.

Recommendations For PHP-Nuke versions 5.2 and earlier, except 5.0RC1, consider restricting access to the "admin.php" endpoint to prevent unauthorized file uploads until a fix is available. As a temporary workaround, disable the upload functionality in "admin.php" to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-1032

Produtos afetados

Php-Nuke

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2001-09/0203.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1032 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7170 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1032 · Nota
• http://sourceforge.net/forum/forum.php?forum_id=113892 · Nota
• http://securityfocus.com/bid/3361 · Nota