$ cve CVE-2004-2044 JSON

CVE-2004-2044 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 11% (pctl 96)

Patch early

A public exploit exists.

Description

PHP-Nuke 7.3, and other products that use the PHP-Nuke codebase such as the Nuke Cops betaNC PHP-Nuke Bundle, OSCNukeLite 3.1, and OSC2Nuke 7x do not properly use the eregi() PHP function with $_SERVER['PHP_SELF'] to identify the calling script, which allows remote attackers to directly access scripts, obtain path information via a PHP error message, and possibly gain access, as demonstrated using an HTTP request that contains the "admin.php" string.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	11.05% — more likely to be exploited than 96% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-06-01
Last modified	2026-06-16

Affected (4)

Vendor	Product
francisco burzi	php-nuke
oscommerce	osc2nuke
paul laudanski	betanc php-nuke
trustix	secure linux

Public exploits

Source	Title	Date
exploit-db	PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass	2004-06-01

References

→ the Explorer · watch your stack · NVD