CVE-2007-5772 Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory...
MediumCVSS 6.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthenticated remote attackers can exploit this by leveraging a cookie manipulation issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flatnuke3 | All versions | No fix listed |
References
- 43636 vdb-entry
- 20071025 Flatnuke3 Remote Cookie Manipoulation / Privilege Escalation mailing-list
- 4562 exploit