PT-2007-6172 · Php Nuke Team · Php-Nuke

H4Ck3R · Publicado 2007-09-24 · Atualizado 2018-10-15 · CVE-2007-5069

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nuke Mobile Entertainment 1 addon for PHP-Nuke (affected versions not specified)

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module name parameter. This can be exploited by sending a request to a vulnerable API endpoint, although the specific endpoint is not mentioned. The attack involves using the module name parameter to traverse directories and access files that should be restricted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5069

Produtos afetados

Php-Nuke

Referências · 7

• 🔥 https://exploit-db.com/exploits/4447 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36745 · Nota
• http://securityfocus.com/archive/1/480441/100/0/threaded · Nota
• http://vupen.com/english/advisories/2007/3252 · Nota
• http://secunia.com/advisories/26923 · Nota
• http://securityfocus.com/bid/25784 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5069 · Nota de Segurança