PT-2004-2729 · Php Nuke · Php-Nuke+1

Janek Vind + 1 · Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-1830

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 6.0

Description The issue allows remote attackers to obtain sensitive information via an invalid language, newlang, or lang parameter in the error.php file of Error Manager 2.1 for PHP-Nuke. This results in the leakage of the pathname in a PHP error message.

Recommendations For PHP-Nuke version 6.0, consider restricting access to the error.php file in Error Manager 2.1 to minimize the risk of exploitation. Avoid using the parameters language, newlang, or lang with invalid values in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-1830

Affected Products

Error Manager

Php-Nuke

References · 8

• 🔥 https://exploit-db.com/exploits/23844 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1830 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1830 · Note
• http://marc.info/?l=bugtraq&m=107963064317560&w=2 · Note
• http://securityfocus.com/bid/9911 · Note
• http://osvdb.org/4386 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15524 · Note
• http://secunia.com/advisories/11164 · Note