PT-2007-6172 · Php Nuke Team · Php-Nuke

H4Ck3R · Published 2007-09-24 · Updated 2018-10-15 · CVE-2007-5069

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nuke Mobile Entertainment 1 addon for PHP-Nuke (affected versions not specified)

Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module name parameter. This can be exploited by sending a request to a vulnerable API endpoint, although the specific endpoint is not mentioned. The attack involves using the module name parameter to traverse directories and access files that should be restricted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5069

Affected Products

Php-Nuke

References · 7

• 🔥 https://exploit-db.com/exploits/4447 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5069 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36745 · Note
• http://securityfocus.com/archive/1/480441/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/3252 · Note
• http://secunia.com/advisories/26923 · Note
• http://securityfocus.com/bid/25784 · Note