CVE-2001-0854: Medium severity Francisco Burzi PHP-Nuke vulnerability

Published Nov 22, 2001

Updated

PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHPSELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user.

Affected Software

1 affected component

Francisco Burzi PHP-Nuke=5.2

Event History

Nov 22, 2001

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-0854?

CVE-2001-0854 is considered a critical vulnerability due to the potential for remote file manipulation.

How do I fix CVE-2001-0854?

Fix CVE-2001-0854 by upgrading to a version of PHP-Nuke later than 5.2 that addresses this vulnerability.

What type of attacks does CVE-2001-0854 allow?

CVE-2001-0854 allows remote attackers to copy and delete arbitrary files on the affected system.

Which versions of PHP-Nuke are affected by CVE-2001-0854?

CVE-2001-0854 specifically affects PHP-Nuke version 5.2.

What conditions must be met for CVE-2001-0854 to be exploited?

CVE-2001-0854 can be exploited when the case.filemanager.php is called with admin.php as an argument, improperly setting the $PHP_SELF variable.