CVE-2007-5092 Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (d...
MediumCVSS 6.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in an ACCEPT_FILE array parameter to modules.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| multimedia dance music module for phpnuke | All versions | No fix listed |
References
- 37335 vdb-entry
- 26958 third-party-advisory
- 3169 third-party-advisory
- 20070925 [waraxe-2007-SA#054] - Local File Inclusion in Dance Music module for phpNuke mailing-list
- 25806 vdb-entry
- www.waraxe.us
- dancemusic-module-file-include(36772) vdb-entry