PT-2005-2851 · Flatnuke · Flatnuke

Published 2005-06-08 · Updated 2024-02-13 · CVE-2005-1894

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FlatNuke version 2.5.3

Description A direct code injection issue allows remote attackers to execute arbitrary PHP code by placing the code into the referer header of an HTTP request. This causes the code to be injected into referer.php, which can then be accessed by the attacker.

Recommendations For FlatNuke version 2.5.3, consider restricting access to the referer.php file as a temporary workaround until a patch is available. Avoid using the referer header in HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2005-1894

Affected Products

Flatnuke

References · 8

• 🔥 https://exploit-db.com/exploits/25801 · Exploit
• 🔥 http://securitytracker.com/id?1014114 · Exploit
• 🔥 http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt · Exploit
• http://flatnuke.sourceforge.net/index.php?mod=read&id=1117979256 · Patch
• http://secunia.com/advisories/15603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1894 · Security Note
• https://t.me/cvenotify/71246 · Telegram Post
• http://vupen.com/english/advisories/2005/0697 · Note