PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2005-05-10T04:00:00
Updated: 2017-07-10T14:57:01
Reserved: 2005-05-04T00:00:00
Link: CVE-2004-2044
JSON object: View
NVD Information
Status : Modified
Published: 2004-06-01T04:00:00.000
Modified: 2017-07-11T01:31:34.967
Link: CVE-2004-2044
JSON object: View
Redhat Information
No data.
CWE