| Package | Affected versions | Patched versions |
|---|---|---|
| php-nuke | = 5.0= 5.0.1= 5.1= 5.2= 5.2a= 5.3.1= 5.4= 5.5= 5.6= 6.0= 6.5= 6.5_beta1= 6.5_final= 6.5_rc1= 6.5_rc2= 6.5_rc3= 6.6= 6.7= 6.9= 7.0= 7.0_final= 7.1= 7.2= 7.3 | |
| osc2nuke | = 7x_1.0 | |
| betanc php-nuke | = bundle |
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free