PT-2005-1495 · Php · Php-Nuke

Janek Vind + 1 · Publicado 2005-02-15 · Atualizado 2017-07-11 · CVE-2005-0433

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Php-Nuke version 7.5

Description The issue allows remote attackers to determine the full path of the web server via invalid or missing arguments to certain PHP files, including "db.php", "mainfile.php", "Downloads/index.php", or "Web Links/index.php". This is possible because the PHP error message lists the path when such invalid or missing arguments are provided.

Recommendations For Php-Nuke version 7.5, consider restricting access to the affected PHP files, such as "db.php", "mainfile.php", "Downloads/index.php", and "Web Links/index.php", to prevent remote attackers from determining the full path of the web server. Additionally, as a temporary workaround, consider disabling the display of PHP error messages to minimize the risk of path disclosure.

Exploit

Correção

Identificadores relacionados

CVE-2005-0433

Produtos afetados

Php-Nuke

Referências · 5

• 🔥 http://securityfocus.com/bid/12561 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19344 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0433 · Nota de Segurança
• http://waraxe.us/advisory-40.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0433 · Nota