PT-2007-6189 · Php Nuke · Php-Nuke

Janek Vind + 1 · Publicado 2007-09-26 · Atualizado 2018-10-15 · CVE-2007-5092

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpNuke Dance Music module (affected versions not specified)

Description The issue concerns a directory traversal vulnerability in the index.php file of the Dance Music module for phpNuke. This vulnerability can be exploited when the register globals setting is enabled, allowing remote attackers to include and execute arbitrary local files. The exploitation is achieved by using a .. (dot dot) sequence in an ACCEPT FILE array parameter to the "modules.php" endpoint.

Recommendations For the phpNuke Dance Music module, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the "modules.php" endpoint to minimize the risk of exploitation. Avoid using the ACCEPT FILE array parameter in the "modules.php" endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-5092

Produtos afetados

Php-Nuke

Referências · 9

• 🔥 https://exploit-db.com/exploits/30614 · Exploit
• http://securityreason.com/securityalert/3169 · Nota
• http://secunia.com/advisories/26958 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36772 · Nota
• http://securityfocus.com/bid/25806 · Nota
• http://osvdb.org/37335 · Nota
• http://waraxe.us/advisory-54.html · Nota
• http://securityfocus.com/archive/1/480578/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5092 · Nota de Segurança