PT-2011-3161 · Php Nuke · Php-Nuke

Publicado 2011-06-21 · Atualizado 2018-08-13 · CVE-2011-1482

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 8.0 and earlier

Description The issue allows remote attackers to hijack the authentication of administrators for requests, including adding user accounts or granting administrative privileges to a user account. This is related to a Referer check that uses a substring comparison in the mainfile.php file.

Recommendations For PHP-Nuke versions 8.0 and earlier, consider disabling the functionality related to adding user accounts and granting administrative privileges until a proper fix is applied, to minimize the risk of exploitation. Restrict access to the mainfile.php file to prevent unauthorized requests.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2011-1482

Produtos afetados

Php-Nuke

Referências · 5

• 🔥 http://openwall.com/lists/oss-security/2011/03/30/8 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/03/23/9 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1482 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1482 · Nota de Segurança
• http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_request_forgery · Nota