CVE-2008-4767

Published: Oct 28, 2008Modified: Apr 23, 2026

9.0

Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 8.0 / Impact: 10.0

Source: NVD

Description

Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.

Affected (1)

Products: Php Nuke: Downloadsplus Module

1 product

Downloadsplus Module

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Php Nuke Downloadsplus Module	All versions

Running on/with	Platform Versions
Phpnuke Php Nuke	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

http://www.juniper.net/security/auto/vulnerabilities/vuln28919.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/28919

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/42007

Source: cve@mitre.org

http://www.juniper.net/security/auto/vulnerabilities/vuln28919.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/28919

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/42007

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.