PT-2004-2853 · Postnuke · Postnuke

Janek Vind + 1 · Published 2004-04-21 · Updated 2017-07-11 · CVE-2004-1956

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PostNuke version 0.7.2.6

Description The issue allows remote attackers to gain information via a direct HTTP request to specific files and directories, which reveals the path to the web server in a PHP error message. The affected directories and modules include includes/blocks, pnadodb, NS-NewUser, NS-Your Account, NS-LostPassword, and NS-User.

Recommendations For PostNuke version 0.7.2.6, restrict access to the includes/blocks, pnadodb, NS-NewUser, NS-Your Account, NS-LostPassword, and NS-User modules to minimize the risk of exploitation. Consider implementing proper error handling to prevent the disclosure of sensitive information, such as the web server path.

Exploit

Fix

Related Identifiers

CVE-2004-1956

Affected Products

Postnuke

References · 5

• 🔥 http://waraxe.us/index.php?modname=sa&id=22 · Exploit
• 🔥 http://securityfocus.com/bid/10191 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1956 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15933 · Note
• http://marc.info/?l=bugtraq&m=108258902000472&w=2 · Note