PT-2004-2436 · Php Nuke · The Events Calendar

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1528

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Event Calendar module version 2.13 for PHP-Nuke

Description The issue allows remote attackers to gain sensitive information via an HTTP request to specific API endpoints, such as "config.php", "index.php", or "submit.php". These endpoints reveal the full path in an error message, potentially exposing sensitive data.

Recommendations For The Event Calendar module version 2.13, consider restricting access to the "config.php", "index.php", and "submit.php" endpoints to minimize the risk of exploitation. As a temporary workaround, avoid using these endpoints until a patch is available or apply configuration changes to prevent error messages from revealing sensitive information.

Exploit

Fix

Related Identifiers

CVE-2004-1528

Affected Products

The Events Calendar

References · 6

• 🔥 http://securityfocus.com/bid/11693 · Exploit
• 🔥 http://secunia.com/advisories/13213 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1528 · Security Note
• http://marc.info/?l=bugtraq&m=110064626111756&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18105 · Note
• http://waraxe.us/index.php?modname=sa&id=38 · Note