medium6.0Public exploit code
CVE-2007-5772
Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Flatnuke 3 - Remote Cookie Manipulation / Privilege Escalation2007-10-23 · webapps · php · Verified
Impact
Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthenticated remote attackers can exploit this by leveraging a cookie manipulation issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flatnuke3 | Flatnuke3 | All versions |