CVE-2004-2044: francisco_burzi php-nuke
Vulnerability summary
CVE-2004-2044 is a high (CVSS 7.5) vulnerability in francisco_burzi php-nuke. EPSS estimates a 11.05% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 10-05-2005PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.05%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.05% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (securityfocus.com)
Maturity: unknown
PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Francisco_burzi1 product
- php-nuke5.0 | 5.0.1 | 5.1 | 5.2 | 5.2a | 5.3.1 | 5.4 | 5.5 | 5.6 | 6.0 | 6.5 | 6.5_beta1 | 6.5_final | 6.5_rc1 | 6.5_rc2 | 6.5_rc3 | 6.6 | 6.7 | 6.9 | 7.0 | 7.0_final | 7.1 | 7.2 | 7.3
Oscommerce1 product
- osc2nuke7x_1.0
Paul_laudanski1 product
- betanc_php-nukebundle
Trustix1 product
- secure_linux2.0 | 2.1
4 vendors · 4 products