NVD

Id
72421  
Name
CVE-2004-2044  
Description
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-07-18  
Published
2004-06-01  
Modified Date
2017-07-10  
Seq
2004-2044  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
373756 72421 CVE-2004-2044 20040601 [Squid 2004-betaNC-001] Inadequate Security Checking in NukeCops betaNC Bundle  View
373757 72421 CVE-2004-2044 20040601 [Squid 2004-OSC2Nuke-001] Inadequate Security Checking in OSC2Nuke  View
373758 72421 CVE-2004-2044 20040601 [Squid 2004-betaNC-001] Inadequate Security Checking in NukeCops  View
373759 72421 CVE-2004-2044 20040601 [Squid 2004-Nuke-001] Inadequate Security Checking in PHPNuke  View
373760 72421 CVE-2004-2044 20040606 Re: [Squid 2004-Nuke-001] Inadequate Security Checking in PHPNuke  View
373761 72421 CVE-2004-2044 10447  View
373762 72421 CVE-2004-2044 phpnuke-eregi-path-disclosure(16294)  View
373763 72421 CVE-2004-2044 osc2nuke-eregi-path-disclosure(16296)  View
373764 72421 CVE-2004-2044 oscnukelite-eregi-path-disclosure(16297)  View
373765 72421 CVE-2004-2044 nukecops-ergei-path-disclosure(16298)  View

Related JVN