PT-2007-7234 · Php · Php-Nuke

Published 2007-12-15 · Updated 2008-11-15 · CVE-2007-6376

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 8.0

Description A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the filename parameter of the autohtml.php file.

Recommendations For PHP-Nuke version 8.0, restrict access to the autohtml.php file to prevent exploitation, and consider implementing input validation to prevent directory traversal attacks via the filename parameter.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-6376

Affected Products

Php-Nuke

References · 5

• 🔥 https://exploit-db.com/exploits/30881 · Exploit
• 🔥 http://securityfocus.com/bid/26807 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6376 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6376 · Note
• http://osvdb.org/39507 · Note