PT-2007-6739 · Flatnuke · Flatnuke

Kingoftheworld · Published 2007-11-01 · Updated 2018-10-15 · CVE-2007-5772

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Flatnuke version 3

Description A direct static code injection issue exists in the download module, allowing remote authenticated administrators to inject arbitrary PHP code into a description.it.php file by saving a description and setting fneditmode to 1. Unauthenticated remote attackers can also exploit this issue by leveraging a cookie manipulation problem.

Recommendations For Flatnuke version 3, as a temporary workaround, consider disabling the download module until a patch is available. Restrict access to the description.it.php file to minimize the risk of exploitation. Avoid using the fneditmode variable in the affected module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2007-5772

Affected Products

Flatnuke

References · 4

• 🔥 https://exploit-db.com/exploits/4562 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5772 · Security Note
• http://securityfocus.com/archive/1/482774/100/0/threaded · Note
• http://osvdb.org/43636 · Note