PT-2003-2413 · Php Nuke · Php-Nuke

Published 2003-12-31 · Updated 2017-07-29 · CVE-2003-1468

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 6.0 through 6.5 final

Description The issue allows remote attackers to obtain the full web server path. This is achieved by providing an invalid cid parameter that is non-numeric or null, resulting in the pathname being leaked in an error message.

Recommendations For PHP-Nuke versions 6.0 through 6.5 final, consider restricting access to the Web Links module until a fix is available, or avoid using non-numeric or null values for the cid parameter to minimize the risk of path disclosure.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2003-1468

Affected Products

Php-Nuke

References · 6

• 🔥 http://securityfocus.com/bid/7589 · Exploit
• 🔥 http://securityfocus.com/archive/1/321313 · Exploit
• 🔥 https://exploit-db.com/exploits/22598 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1468 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12436 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1468 · Note