Lucene search

[email protected]CVE-2004-2044

HistoryMay 10, 2005 - 4:00 a.m.

CVE-2004-2044

2005-05-1004:00:00

[email protected]

web.nvd.nist.gov

cve-2004-2044

php-nuke

security vulnerability

remote access

php function

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.2 High

AI Score

Confidence

High

0.374 Low

EPSS

Percentile

97.2%

JSON

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER[‘PHP_SELF’] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the “admin.php” string.

Affected configurations

NVD

Node

francisco_burziphp-nukeMatch5.0

francisco_burziphp-nukeMatch5.0.1

francisco_burziphp-nukeMatch5.1

francisco_burziphp-nukeMatch5.2

francisco_burziphp-nukeMatch5.2a

francisco_burziphp-nukeMatch5.3.1

francisco_burziphp-nukeMatch5.4

francisco_burziphp-nukeMatch5.5

francisco_burziphp-nukeMatch5.6

francisco_burziphp-nukeMatch6.0

francisco_burziphp-nukeMatch6.5

francisco_burziphp-nukeMatch6.5_beta1

francisco_burziphp-nukeMatch6.5_final

francisco_burziphp-nukeMatch6.5_rc1

francisco_burziphp-nukeMatch6.5_rc2

francisco_burziphp-nukeMatch6.5_rc3

francisco_burziphp-nukeMatch6.6

francisco_burziphp-nukeMatch6.7

francisco_burziphp-nukeMatch6.9

francisco_burziphp-nukeMatch7.0

francisco_burziphp-nukeMatch7.0_final

francisco_burziphp-nukeMatch7.1

francisco_burziphp-nukeMatch7.2

francisco_burziphp-nukeMatch7.3

oscommerceosc2nukeMatch7x_1.0

paul_laudanskibetanc_php-nukeMatchbundle

Node

trustixsecure_linuxMatch2.0

trustixsecure_linuxMatch2.1

CPENameOperatorVersion
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.0
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.0.1
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.1
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.2
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.2a
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.3.1
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.4
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.5
francisco_burzi:php-nukefrancisco burzi php-nukeeq5.6
francisco_burzi:php-nukefrancisco burzi php-nukeeq6.0

CPE	Name	Operator	Version
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.0
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.0.1
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.1
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.2
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.2a
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.3.1
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.4
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.5
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	5.6
francisco_burzi:php-nuke	francisco burzi php-nuke	eq	6.0

Rows per page:

1-10 of 261

References

archives.neohapsis.com/archives/bugtraq/2004-06/0005.html

archives.neohapsis.com/archives/bugtraq/2004-06/0006.html

marc.info/?l=bugtraq&m=108611606320559&w=2

marc.info/?l=bugtraq&m=108611643614881&w=2

marc.info/?l=bugtraq&m=108662955105757&w=2

secunia.com/advisories/11766

www.osvdb.org/6593

www.securityfocus.com/bid/10447

exchange.xforce.ibmcloud.com/vulnerabilities/16294

exchange.xforce.ibmcloud.com/vulnerabilities/16296

exchange.xforce.ibmcloud.com/vulnerabilities/16297

exchange.xforce.ibmcloud.com/vulnerabilities/16298

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.2 High

AI Score

Confidence

High

0.374 Low

EPSS

Percentile

97.2%

JSON

Related for CVE-2004-2044

cvelist1 nvd1