CVE-2004-1937

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 8.1%

from disclosure to weapon0 days

Published on NVDMay 10

1st PoCApr 12

exploitation probability

8.1%top 6% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/23988

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://marc.info/?l=bugtraq&m=108222826225823&w=2 http://secunia.com/advisories/11341 https://exchange.xforce.ibmcloud.com/vulnerabilities/15843 https://exchange.xforce.ibmcloud.com/vulnerabilities/15844 http://www.phpsecure.info/v2/tutos/frog/Nuked-KlaN.txt http://www.securityfocus.com/bid/10104