Vulnerabilities > CVE-2004-2044

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

exploit available

NVD

Published: 2004-06-01

Updated: 2024-11-20

Summary

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.

Vulnerable Configurations

Part	Description	Count
Application	Francisco_Burzi Francisco Burzi PHP Nuke 5.3.1 Francisco Burzi PHP Nuke 5.1 Francisco Burzi PHP Nuke 6.5_Beta1 Francisco Burzi PHP Nuke 6.5 Francisco Burzi PHP Nuke 7.0 Francisco Burzi PHP Nuke 5.0 Francisco Burzi PHP Nuke 5.4 Francisco Burzi PHP Nuke 6.5_Rc2 Francisco Burzi PHP Nuke 6.5_Rc3 Francisco Burzi PHP Nuke 7.2 Francisco Burzi PHP Nuke 7.3 Francisco Burzi PHP Nuke 5.5 Francisco Burzi PHP Nuke 5.0.1 Francisco Burzi PHP Nuke 5.2 Francisco Burzi PHP Nuke 5.2A Francisco Burzi PHP Nuke 7.0_Final Francisco Burzi PHP Nuke 5.6 Francisco Burzi PHP Nuke 6.0 Francisco Burzi PHP Nuke 6.5_Final Francisco Burzi PHP Nuke 6.6 Francisco Burzi PHP Nuke 6.7 Francisco Burzi PHP Nuke 6.9 Francisco Burzi PHP Nuke 6.5_Rc1 Francisco Burzi PHP Nuke 7.1	24
Application	Oscommerce Oscommerce Osc2Nuke 7X_1.0	1
Application	Paul_Laudanski Paul Laudanski Betanc PHP Nuke Bundle	1
OS	Trustix Trustix Secure Linux 2.0 Trustix Secure Linux 2.1	2

Exploit-Db

description	PHP-Nuke 5.x/6.x/7.x Direct Script Access Security Bypass Vulnerability. CVE-2004-2044. Webapps exploit for php platform
id	EDB-ID:24166
last seen	2016-02-02
modified	2004-06-01
published	2004-06-01
reporter	Squid
source	https://www.exploit-db.com/download/24166/
title	PHP-Nuke 5.x/6.x/7.x Direct Script Access Security Bypass Vulnerability

Vulnerabilities > CVE-2004-2044 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2004-2044"}]}

Summary

Vulnerable Configurations

Exploit-Db

References

Vulnerabilities > CVE-2004-2044