Vulnerability in Flatnuke
CVE-2005-4449
verify.php in FlatNuke 2.5.6 allows remote authenticated administrators to modify arbitrary PHP files by setting the file parameter to an arbitrary file and injecting the code into the body parameter. NOTE: if a FlatNuke administrator is normally assumed to be able to modify arbitrary content, then this issue does not cross privilege boundaries and would not be a vulnerability.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.0 (Medium). Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.046 (91.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.046 · newest: 0.046 · change: 0.000
Affected products
- Flatnuke — versions 2.5.6
References
- exchange.xforce.ibmcloud.com/vulnerabilities/22159 (vdb-entry)
- cvs.sourceforge.net/viewcvs.py/flatnuke/flatnuke/Changelog
- www.securityfocus.com/archive/1/419107 (mailing-list, Exploit)
- securitytracker.com/id (Exploit, vdb-entry)
- securityreason.com/securityalert/248 (third-party-advisory)