CVE-2004-1937 - CVE House
Back to Database
Status published Medium CVE-2004-1937

Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow...

Vulnerability Description

Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the user_langue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the user_langue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2004-1937

Credits & Attribution

No credits recorded in the NVD database.

References

More from nuked-klan

View All →
CVE-2010-4925
SQL injection vulnerability in clic.php in the Partenaires module 1.5...
High 7.5
CVE-2008-7132
Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.3 beta...
Medium 4.3
CVE-2007-6090
Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.7.5 allows...
Medium 4.3
CVE-2007-2556
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to...
High 7.5
CVE-2007-0083
Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier...
Medium 6.8

Affected Vendor

Affected Software

nuked-klan
Vulnerable Versions:
1.2, 1.2_beta, 1.3, 1.3_beta, 1.4, 1.5, 1.5_sp2

Timeline

Official Publish: May 10th, 2005
Last Modified: August 8th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.