CVE-2002-0206: High severity Francisco Burzi PHP-Nuke vulnerability

Published May 3, 2002

Updated

index.php in Francisco Burzi PHP-Nuke 5.3.1 and earlier, and possibly other versions before 5.5, allows remote attackers to execute arbitrary PHP code by specifying a URL to the malicious code in the file parameter.

Affected Software

13 affected components

Francisco Burzi PHP-Nuke=4.0

Francisco Burzi PHP-Nuke=5.3.1

Francisco Burzi PHP-Nuke=5.1

Francisco Burzi PHP-Nuke=4.3

Francisco Burzi PHP-Nuke=1.0

Francisco Burzi PHP-Nuke=4.4

Francisco Burzi PHP-Nuke=2.5

Francisco Burzi PHP-Nuke=3.0

Francisco Burzi PHP-Nuke=5.0

Francisco Burzi PHP-Nuke=5.2a

Francisco Burzi PHP-Nuke=5.0.1

Francisco Burzi PHP-Nuke=5.2

Francisco Burzi PHP-Nuke=4.4.1a

Event History

May 3, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-0206?

CVE-2002-0206 has been classified as a critical vulnerability due to its ability to allow arbitrary PHP code execution.

How does CVE-2002-0206 work?

CVE-2002-0206 allows remote attackers to execute arbitrary PHP code by specifying a malicious URL in the file parameter of index.php.

Which versions of PHP-Nuke are affected by CVE-2002-0206?

CVE-2002-0206 affects PHP-Nuke versions 5.3.1 and earlier, as well as possibly other prior versions.

How do I fix CVE-2002-0206?

To fix CVE-2002-0206, upgrade to a patched version of PHP-Nuke that addresses this vulnerability.

Is there a workaround for CVE-2002-0206?

A potential workaround for CVE-2002-0206 is to restrict access to the index.php file or to disable file parameter functionality.