PT-2004-3256 · Phpx · Phpx

Published 2004-12-31 · Updated 2024-02-14 · CVE-2004-2362

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PHPX versions 3.2.6 and earlier

Description: The issue allows remote attackers to obtain the physical path of PHPX by providing a null or invalid value in the limit parameter. This results in the pathname being leaked in a database error message. An example of this can be seen in the forums.php file.

Recommendations: For PHPX versions 3.2.6 and earlier, consider validating and sanitizing the limit parameter to prevent the injection of null or invalid values, which could mitigate the risk of pathname leakage. Additionally, as a temporary workaround, restrict access to the forums.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-2362

Affected Products

Phpx

References · 7

• 🔥 http://securityfocus.com/archive/1/362230 · Exploit
• http://phpx.org/project.php?action=view&project_id=1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-2362 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16064 · Note
• http://secunia.com/advisories/11554 · Note
• http://securitytracker.com/id?1010061 · Note
• http://osvdb.org/5906 · Note