PT-2005-5132 · Flatnuke · Flatnuke

Rgod · Publicado 2005-12-21 · Atualizado 2017-07-20 · CVE-2005-4449

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FlatNuke version 2.5.6

Description The issue in FlatNuke allows remote authenticated administrators to modify arbitrary PHP files. This is achieved by setting the file parameter to an arbitrary file and injecting code into the body parameter in the verify.php file. However, if a FlatNuke administrator is normally assumed to have the privilege to modify arbitrary content, this issue does not cross privilege boundaries.

Recommendations For FlatNuke version 2.5.6, consider restricting access to the verify.php file to prevent unauthorized modification of PHP files until a fix is available. As a temporary workaround, restrict the ability to inject code into the body parameter to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-4449

Produtos afetados

Flatnuke

Referências · 7

• 🔥 http://securityfocus.com/archive/1/419107 · Exploit
• 🔥 https://exploit-db.com/exploits/1367 · Exploit
• 🔥 http://securitytracker.com/id?1015339 · Exploit
• http://securityreason.com/securityalert/248 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 · Nota
• http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4449 · Nota de Segurança