1. CVE-Search
  2. CVE-2004-1937
ID CVE-2004-1937
Summary Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.
References
Vulnerable Configurations
  • cpe:2.3:a:nuked-klan:nuked-klan:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:nuked-klan:nuked-klan:1.2_beta:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.2_beta:*:*:*:*:*:*:*
  • cpe:2.3:a:nuked-klan:nuked-klan:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:nuked-klan:nuked-klan:1.3_beta:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.3_beta:*:*:*:*:*:*:*
  • cpe:2.3:a:nuked-klan:nuked-klan:1.4:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:nuked-klan:nuked-klan:1.5:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:nuked-klan:nuked-klan:1.5_sp2:*:*:*:*:*:*:*
    cpe:2.3:a:nuked-klan:nuked-klan:1.5_sp2:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-07-2017 - 01:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
bid 10104
bugtraq 20040417 [SCSA-028] Nuked-Klan Multiple Vulnerabilities
misc http://www.phpsecure.info/v2/tutos/frog/Nuked-KlaN.txt
secunia 11341
xf
  • nuked-klan-configurtion-corruption(15844)
  • nuked-klan-file-include(15843)
Last major update 11-07-2017 - 01:31
Published 31-12-2004 - 05:00
Last modified 11-07-2017 - 01:31
Back to Top