Description
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass EDB-24166 · webapps · Jun 1, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20040601 [Squid 2004-betaNC-001] Inadequate Security Checking in NukeCops betaNC Bundle mailing-list
- nukecops-ergei-path-disclosure(16298) vdb-entry
- 20040601 [Squid 2004-OSC2Nuke-001] Inadequate Security Checking in OSC2Nuke mailing-list
- phpnuke-eregi-path-disclosure(16294) vdb-entry
- oscnukelite-eregi-path-disclosure(16297) vdb-entry
- 6593 vdb-entry
- 20040606 Re: [Squid 2004-Nuke-001] Inadequate Security Checking in PHPNuke mailing-list
- 10447 vdb-entry
- 20040601 [Squid 2004-betaNC-001] Inadequate Security Checking in NukeCops mailing-list
- osc2nuke-eregi-path-disclosure(16296) vdb-entry
- 11766 third-party-advisory
- 20040601 [Squid 2004-Nuke-001] Inadequate Security Checking in PHPNuke mailing-list