CVE-2005-1028 PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) index.php with the forum_admin parameter set, (2) the Surveys module, or (3) the Your_Accou...
MediumCVSS 5.0
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP-Nuke 6.x through 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) index.php with the forum_admin parameter set, (2) the Surveys module, or (3) the Your_Account module, which reveals the path in a PHP error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phpnuke php-nuke | >= 6.0, <= 7.6 | No fix listed |
References
- 20050404 [SECURITYREASON.COM] Full path disclosure and XSS in PHPNuke part 3 mailing-list third-party-advisory