PT-2004-2729 · Php Nuke · Php-Nuke+1

Janek Vind + 1 · Publicado 2004-03-18 · Atualizado 2017-07-11 · CVE-2004-1830

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 6.0

Description The issue allows remote attackers to obtain sensitive information via an invalid language, newlang, or lang parameter in the error.php file of Error Manager 2.1 for PHP-Nuke. This results in the leakage of the pathname in a PHP error message.

Recommendations For PHP-Nuke version 6.0, consider restricting access to the error.php file in Error Manager 2.1 to minimize the risk of exploitation. Avoid using the parameters language, newlang, or lang with invalid values in the affected API endpoint until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2004-1830

Produtos afetados

Error Manager

Php-Nuke

Referências · 8

• 🔥 https://exploit-db.com/exploits/23844 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1830 · Nota
• http://marc.info/?l=bugtraq&m=107963064317560&w=2 · Nota
• http://securityfocus.com/bid/9911 · Nota
• http://osvdb.org/4386 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15524 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1830 · Nota de Segurança
• http://secunia.com/advisories/11164 · Nota