PT-2001-2020 · Php · Php-Nuke

Published 2001-11-22 · Updated 2016-10-18 · CVE-2001-0854

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 5.2

Description The issue allows remote attackers to copy and delete arbitrary files. This is achieved by calling case.filemanager.php with admin.php as an argument, which manipulates the $PHP SELF variable. As a result, it appears that case.filemanager.php is being called by admin.php instead of the user.

Recommendations For PHP-Nuke version 5.2, consider restricting access to the case.filemanager.php file until a proper fix is available. Additionally, review the configuration and permissions of the $PHP SELF variable to prevent manipulation.

Fix

Related Identifiers

CVE-2001-0854

Affected Products

Php-Nuke

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-0854 · Security Note
• http://marc.info/?l=bugtraq&m=100525739116093&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0854 · Note
• http://securityfocus.com/bid/3510 · Note
• http://iss.net/security_center/static/7478.php · Note