PT-2004-2436 · Php Nuke · The Events Calendar

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1528

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Event Calendar module version 2.13 for PHP-Nuke

Description The issue allows remote attackers to gain sensitive information via an HTTP request to specific API endpoints, such as "config.php", "index.php", or "submit.php". These endpoints reveal the full path in an error message, potentially exposing sensitive data.

Recommendations For The Event Calendar module version 2.13, consider restricting access to the "config.php", "index.php", and "submit.php" endpoints to minimize the risk of exploitation. As a temporary workaround, avoid using these endpoints until a patch is available or apply configuration changes to prevent error messages from revealing sensitive information.

Exploit

Correção

Identificadores relacionados

CVE-2004-1528

Produtos afetados

The Events Calendar

Referências · 6

• 🔥 http://securityfocus.com/bid/11693 · Exploit
• 🔥 http://secunia.com/advisories/13213 · Exploit
• http://marc.info/?l=bugtraq&m=110064626111756&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18105 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1528 · Nota de Segurança
• http://waraxe.us/index.php?modname=sa&id=38 · Nota