Sign-up

ID

VAR-200403-0109


CVE

CVE-2004-1830


TITLE

PHP-Nuke Error Manager Multiple security holes in the module

Trust: 0.6

sources: CNNVD: CNNVD-200403-086

DESCRIPTION

error.php in Error Manager 2.1 for PHP-Nuke 6.0 allows remote attackers to obtain sensitive information via an invalid (1) language, (2) newlang, or (3) lang parameter, which leaks the pathname in a PHP error message. It has been reported that Error Manager is prone to multiple vulnerabilities. These issues are due to failure to validate user input, failure to handle exceptional conditions and simple design errors. These issues may be leveraged to carry out cross-site scripting attacks, reveal information about the application configuration and initiate HTML injection attacks against the affected system. PHP-Nuke is a popular website creation and management tool, it can use many database software as backend, such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. 1) The path leakage problem exists in the error.php file. Submitting any parameter to \'\'newlang\'\' can return sensitive information including the application installation path. 2) The problem of cross-site script execution attack exists in the error.php file. Due to the lack of sufficient filtering of the \'\'pagetitle\'\' and \'\'error\'\' parameters, the submission contains malicious script code data. When When the target user browses this connection, it can lead to the disclosure of sensitive information. 3) Script injection into the error log Error Manager will record references, request URI and other information when recording log errors, but does not perform any filtering on HTML tags, so attackers can inject thermal instrument script code into the error log, when the administrator views At this time, sensitive information of COOKIE can be stolen, or an administrator account can be established

Trust: 1.26

sources: NVD: CVE-2004-1830 // BID: 9911 // VULHUB: VHN-10259

AFFECTED PRODUCTS

vendor:francisco burzimodel:php-nukescope:eqversion:6.0

Trust: 1.6

vendor:errormodel:manager php-nuke modulescope:eqversion:2.1

Trust: 0.3

sources: BID: 9911 // CNNVD: CNNVD-200403-086 // NVD: CVE-2004-1830

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-1830
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200403-086
value: MEDIUM

Trust: 0.6

VULHUB: VHN-10259
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2004-1830
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-10259
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-10259 // CNNVD: CNNVD-200403-086 // NVD: CVE-2004-1830

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-1830

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200403-086

TYPE

Unknown

Trust: 0.9

sources: BID: 9911 // CNNVD: CNNVD-200403-086

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-10259

EXTERNAL IDS
db:BIDid:9911
Trust: 2.0
db:NVDid:CVE-2004-1830
Trust: 1.7
db:OSVDBid:4386
Trust: 1.7
db:SECUNIAid:11164
Trust: 1.7
db:CNNVDid:CNNVD-200403-086
Trust: 0.7
db:XFid:15524
Trust: 0.6
db:BUGTRAQid:20040318 [WARAXE-2004-SA#010 - MULTIPLE VULNERABILITIES IN ERROR MANAGER
Trust: 0.6
db:EXPLOIT-DBid:23844
Trust: 0.1
db:VULHUBid:VHN-10259
Trust: 0.1
sources:
            
            
            VULHUB: VHN-10259 // 
            
            
            
            BID: 9911 // 
            
            
            
            CNNVD: CNNVD-200403-086 // 
            
            
            
            NVD: CVE-2004-1830

REFERENCES
url:http://www.securityfocus.com/bid/9911
Trust: 1.7
url:http://www.osvdb.org/4386
Trust: 1.7
url:http://secunia.com/advisories/11164
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/15524
Trust: 1.1
url:http://marc.info/?l=bugtraq&m=107963064317560&w=2
Trust: 1.0
url:http://xforce.iss.net/xforce/xfdb/15524
Trust: 0.6
url:http://marc.theaimsgroup.com/?l=bugtraq&m=107963064317560&w=2
Trust: 0.6
url:www.gijza.net
Trust: 0.3
url:/archive/1/357856
Trust: 0.3
url:http://marc.info/?l=bugtraq&m=107963064317560&w=2
Trust: 0.1
sources:
            
            
            VULHUB: VHN-10259 // 
            
            
            
            BID: 9911 // 
            
            
            
            CNNVD: CNNVD-200403-086 // 
            
            
            
            NVD: CVE-2004-1830

CREDITS
Janek Vind※ come2waraxe@yahoo.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200403-086

SOURCES
db:VULHUBid:VHN-10259
db:BIDid:9911
db:CNNVDid:CNNVD-200403-086
db:NVDid:CVE-2004-1830

LAST UPDATE DATE
2024-08-14T13:48:42.797000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-10259date:2017-07-11T00:00:00
db:BIDid:9911date:2004-03-18T00:00:00
db:CNNVDid:CNNVD-200403-086date:2006-09-22T00:00:00
db:NVDid:CVE-2004-1830date:2017-07-11T01:31:23.217

SOURCES RELEASE DATE
db:VULHUBid:VHN-10259date:2004-03-18T00:00:00
db:BIDid:9911date:2004-03-18T00:00:00
db:CNNVDid:CNNVD-200403-086date:2004-03-18T00:00:00
db:NVDid:CVE-2004-1830date:2004-03-18T05:00:00