CVE-2004-1315
PHP-Nuke 7.0/8.1/8.1.35 - Wormable Remote Code Execution
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes the highlight parameter when extracting words and phrases to highlight, which allows remote attackers to execute arbitrary PHP code by double-encoding the highlight value so that special characters are inserted into the result, which is then processed by PHP exec, as exploited by the Santy.A worm.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2004-07-12 First Exploit
- 2004-11-12 CVE Published
- 2004-12-22 CVE Reserved
- 2023-12-08 EPSS Updated
- 2024-08-08 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (15)
| URL | Tag | Source |
|---|---|---|
| http://marc.info/?l=bugtraq&m=110029415208724&w=2 | Mailing List | |
| http://marc.info/?l=bugtraq&m=110365752909029&w=2 | Mailing List | |
| http://marc.info/?t=110079440800004&r=1&w=2 | Mailing List | |
| http://www.securityfocus.com/archive/1/385208 | Mailing List | |
| http://www.securityfocus.com/bid/10701 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/18052 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/12510 | 2010-05-05 | |
| https://www.exploit-db.com/exploits/647 | 2004-11-22 | |
| https://www.exploit-db.com/exploits/16890 | 2010-07-03 | |
| https://www.exploit-db.com/exploits/24274 | 2004-07-12 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/13239 | 2017-07-11 | |
| http://www.kb.cert.org/vuls/id/497400 | 2017-07-11 | |
| http://www.us-cert.gov/cas/techalerts/TA04-356A.html | 2017-07-11 |
| URL | Date | SRC |
|---|---|---|
| http://www.phpbb.com/phpBB/viewtopic.php?t=240513 | 2017-07-11 | |
| https://security.gentoo.org/glsa/200411-32 | 2017-07-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | * | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.0.0 Search vendor "Phpbb Group" for product "Phpbb" and version "1.0.0" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.0.1 Search vendor "Phpbb Group" for product "Phpbb" and version "1.0.1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.2.0 Search vendor "Phpbb Group" for product "Phpbb" and version "1.2.0" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.2.1 Search vendor "Phpbb Group" for product "Phpbb" and version "1.2.1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.4.0 Search vendor "Phpbb Group" for product "Phpbb" and version "1.4.0" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.4.1 Search vendor "Phpbb Group" for product "Phpbb" and version "1.4.1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.4.2 Search vendor "Phpbb Group" for product "Phpbb" and version "1.4.2" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 1.4.4 Search vendor "Phpbb Group" for product "Phpbb" and version "1.4.4" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.0 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.0" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.1 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.2 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.2" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.3 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.3" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.4 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.4" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.5 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.5" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.6 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.6" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.6c Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.6c" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.6d Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.6d" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.7 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.7" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.7a Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.7a" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.8 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.8" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.8a Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.8a" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.9 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.9" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0.10 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0.10" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_beta1 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_beta1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc1 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc1" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc2 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc2" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc3 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc3" | - |
Affected
| ||||||
| Phpbb Group Search vendor "Phpbb Group" | Phpbb Search vendor "Phpbb Group" for product "Phpbb" | 2.0_rc4 Search vendor "Phpbb Group" for product "Phpbb" and version "2.0_rc4" | - |
Affected
| ||||||