PT-2004-2905 · Nukejokes · Nukejokes

Publicado 2004-05-08 · Atualizado 2017-07-11 · CVE-2004-2009

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NukeJokes versions 1.7 through 2 Beta

Description The issue allows remote attackers to obtain the full path of the server. This can be achieved through a direct call to "mainfunctions.php", an invalid jokeid parameter in the JokeView function, or an invalid cat parameter in the CatView function. In each case, the path is revealed in a PHP error message.

Recommendations For NukeJokes versions 1.7 through 2 Beta, consider restricting access to "mainfunctions.php" and validating the jokeid and cat parameters in the JokeView and CatView functions, respectively, to prevent the disclosure of the server path.

Correção

Identificadores relacionados

CVE-2004-2009

Produtos afetados

Nukejokes

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/16094 · Nota
• http://marc.info/?l=bugtraq&m=108404714232579&w=2 · Nota
• http://waraxe.us/index.php?modname=sa&id=28 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2009 · Nota de Segurança