Unscored severity · published May 16, 2005
CVE-2005-1621
Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a
–
CVSS
1.7%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the pnModFunc function in pnMod.php for PostNuke 0.750 through 0.760rc4 allows remote attackers to read arbitrary files via a .. (dot dot) in the func parameter to index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Postnuke · Postnuke Software Foundation
0.750; 0.760_rc2; 0.760_rc3; 0.760_rc4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-1621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-1621
Patch
http://cvs.postnuke.com/viewcvs.cgi/Historic_PostNuke_Library/postnuke-devel/html/includes/pnMod.php.diff?r1=1.47&r2=1.48
marc.info
http://marc.info/?l=bugtraq&m=111627124301526&w=2
news.postnuke.com
http://news.postnuke.com/Article2690.html
news.postnuke.com
http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2691
www.vupen.com
http://www.vupen.com/english/advisories/2005/0553
More from Postnuke
–
CVE-2007-0384
Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVE-2007-0386
Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug."
–
CVE-2007-0385
The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/index.php, possibly involving an…
–
CVE-2006-6267
PostNuke 0.7.5.0, and certain minor versions, allows remote attackers to obtain sensitive information via a non-numeric value of the stop parameter, which reveals the path in an…
–
CVE-2006-6233
SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a…