medium4.0Public exploit code
CVE-2005-4449
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and in…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Flatnuke 2.5.6 - Privilege Escalation / Remote Command Execution2005-12-10 · webapps · php · Verified
Impact
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, then this issue does not cross privilege boundaries and would not be a vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flatnuke | Flatnuke | Version 2.5.6 |
References
- NVD record
- CVE.org record
- http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup
- http://securityreason.com/securityalert/248
- http://securitytracker.com/id?1015339
- http://www.securityfocus.com/archive/1/419107
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22159
- http://cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog?rev=1.78&view=markup
- http://securityreason.com/securityalert/248
- http://securitytracker.com/id?1015339
- http://www.securityfocus.com/archive/1/419107
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22159