PT-2007-6189 · Php Nuke · Php-Nuke

Janek Vind + 1 · Published 2007-09-26 · Updated 2018-10-15 · CVE-2007-5092

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions phpNuke Dance Music module (affected versions not specified)

Description The issue concerns a directory traversal vulnerability in the index.php file of the Dance Music module for phpNuke. This vulnerability can be exploited when the register globals setting is enabled, allowing remote attackers to include and execute arbitrary local files. The exploitation is achieved by using a .. (dot dot) sequence in an ACCEPT FILE array parameter to the "modules.php" endpoint.

Recommendations For the phpNuke Dance Music module, consider disabling the register globals setting to prevent exploitation. As a temporary workaround, restrict access to the "modules.php" endpoint to minimize the risk of exploitation. Avoid using the ACCEPT FILE array parameter in the "modules.php" endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-5092

Affected Products

Php-Nuke

References · 9

• 🔥 https://exploit-db.com/exploits/30614 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5092 · Security Note
• http://securityreason.com/securityalert/3169 · Note
• http://secunia.com/advisories/26958 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36772 · Note
• http://securityfocus.com/bid/25806 · Note
• http://osvdb.org/37335 · Note
• http://waraxe.us/advisory-54.html · Note
• http://securityfocus.com/archive/1/480578/100/0/threaded · Note