PT-2005-5132 · Flatnuke · Flatnuke

Rgod · Published 2005-12-21 · Updated 2017-07-20 · CVE-2005-4449

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FlatNuke version 2.5.6

Description The issue in FlatNuke allows remote authenticated administrators to modify arbitrary PHP files. This is achieved by setting the file parameter to an arbitrary file and injecting code into the body parameter in the verify.php file. However, if a FlatNuke administrator is normally assumed to have the privilege to modify arbitrary content, this issue does not cross privilege boundaries.

Recommendations For FlatNuke version 2.5.6, consider restricting access to the verify.php file to prevent unauthorized modification of PHP files until a fix is available. As a temporary workaround, restrict the ability to inject code into the body parameter to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-4449

Affected Products

Flatnuke

References · 7

• 🔥 http://securityfocus.com/archive/1/419107 · Exploit
• 🔥 https://exploit-db.com/exploits/1367 · Exploit
• 🔥 http://securitytracker.com/id?1015339 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4449 · Security Note
• http://securityreason.com/securityalert/248 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22159 · Note
• http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup · Note