FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php, which triggers an infinite loop, or (2) direct requests to unknown scripts, which reveals the web document root in an error message.
Weakness
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Flatnuke | Flatnuke | * | 2.5.3 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/127.html
- https://cwe.mitre.org/data/definitions/143.html
- https://cwe.mitre.org/data/definitions/144.html
- https://cwe.mitre.org/data/definitions/668.html
- https://cwe.mitre.org/data/definitions/87.html
References
- http://flatnuke.sourceforge.net/index.php?mod=read\u0026id=1117979256
- http://secunia.com/advisories/15603
- http://securitytracker.com/id?1014114
- http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt
- http://www.vupen.com/english/advisories/2005/0697
- http://flatnuke.sourceforge.net/index.php?mod=read\u0026id=1117979256
- http://secunia.com/advisories/15603
- http://securitytracker.com/id?1014114
- http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt
- http://www.vupen.com/english/advisories/2005/0697