PT-2005-3692 · Flatnuke · Flatnuke

Retrogod · Published 2005-09-07 · Updated 2017-07-11 · CVE-2005-2815

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions FlatNuke version 2.5.6

Description The issue allows remote attackers to obtain sensitive information, such as path disclosure on error, or cause a denial of service due to resource consumption. This can be achieved by providing an MS-DOS device name in the news parameter to "print.php", including device names like AUX, CON, PRN, COM1, or LPT1.

Recommendations For FlatNuke version 2.5.6, consider restricting access to the "print.php" file or validating the news parameter to prevent the use of MS-DOS device names as a temporary workaround until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2005-2815

Affected Products

Flatnuke

References · 4

• 🔥 http://securitytracker.com/id?1014824 · Exploit
• 🔥 http://seclists.org/lists/bugtraq/2005/Aug/0440.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2815 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22153 · Note