modules.php in PHP-Nuke 6.x to 7.6 allows remote attackers to obtain sensitive information via a direct request to (1) my_headlines, (2) userinfo, or (3) search, which reveals the path in a PHP error message.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php-nuke | Francisco_burzi | 6.0 (including) | 6.0 (including) |
| Php-nuke | Francisco_burzi | 6.5 (including) | 6.5 (including) |
| Php-nuke | Francisco_burzi | 6.5_beta1 (including) | 6.5_beta1 (including) |
| Php-nuke | Francisco_burzi | 6.5_final (including) | 6.5_final (including) |
| Php-nuke | Francisco_burzi | 6.5_rc1 (including) | 6.5_rc1 (including) |
| Php-nuke | Francisco_burzi | 6.5_rc2 (including) | 6.5_rc2 (including) |
| Php-nuke | Francisco_burzi | 6.5_rc3 (including) | 6.5_rc3 (including) |
| Php-nuke | Francisco_burzi | 6.6 (including) | 6.6 (including) |
| Php-nuke | Francisco_burzi | 6.7 (including) | 6.7 (including) |
| Php-nuke | Francisco_burzi | 6.9 (including) | 6.9 (including) |
| Php-nuke | Francisco_burzi | 7.0 (including) | 7.0 (including) |
| Php-nuke | Francisco_burzi | 7.0_final (including) | 7.0_final (including) |
| Php-nuke | Francisco_burzi | 7.1 (including) | 7.1 (including) |
| Php-nuke | Francisco_burzi | 7.2 (including) | 7.2 (including) |
| Php-nuke | Francisco_burzi | 7.3 (including) | 7.3 (including) |
| Php-nuke | Francisco_burzi | 7.4 (including) | 7.4 (including) |
| Php-nuke | Francisco_burzi | 7.5 (including) | 7.5 (including) |
| Php-nuke | Francisco_burzi | 7.6 (including) | 7.6 (including) |
References
- http://marc.info/?l=bugtraq\u0026m=111263454308478\u0026w=2
- http://www.securityreason.com/adv/PHPNuke%206.x-7.6-p1.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19953
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44980
- http://marc.info/?l=bugtraq\u0026m=111263454308478\u0026w=2
- http://www.securityreason.com/adv/PHPNuke%206.x-7.6-p1.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19953
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44980