CVE-2004-2044 Missing authorization in n/a

High 7.5 Published 10 May 2005 Updated 8 Aug 2024

Remote attackers can bypass authentication to access admin scripts and view path information due to improper script identification logic.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2004-2044?

CVE-2004-2044 is a high-severity missing authorization vulnerability in Francisco Burzi Php-Nuke, published on 10 May 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.

Which versions are affected by CVE-2004-2044?

It affects 4 products.

Products include Francisco Burzi Php-Nuke, Oscommerce Osc2nuke, Paul Laudanski Betanc Php-Nuke, Trustix Secure Linux.

How do I fix CVE-2004-2044?

No fix has been published for CVE-2004-2044 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2004-2044 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-2044 exists.

Public exploit code: 1 Exploit-DB entry.

All Francisco Burzi Php-Nuke vulnerabilities

Sources

Also known as GHSA-wgxc-xgrr-4f53.