CVE-2004-1842

HIGH

Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote attackers to gain administrative privileges via an img tag with a URL to admin.php.

Published: Dec 31, 2004 Modified: Jun 16, 2026

CWE-352

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: REQUIRED Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
phpnuke	php-nuke	* ≥ 6.0

GitHub Security Advisory GHSA-qhg9-6pfj-f2hv

Cross-site request forgery (CSRF) vulnerability in Php-Nuke 6.x through 7.1.0 allows remote...

References (8)

http://marc.info/?l=bugtraq&m=108006309112075&w=2 Mailing List
http://secunia.com/advisories/11195 Broken Link
http://www.securityfocus.com/bid/9895 Broken Link, Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15596 Third Party Advisory, VDB Entry
http://marc.info/?l=bugtraq&m=108006309112075&w=2 Mailing List
http://secunia.com/advisories/11195 Broken Link
http://www.securityfocus.com/bid/9895 Broken Link, Exploit, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/15596 Third Party Advisory, VDB Entry

Risk Scores

CVSS Score 8.8 / 10

EPSS Score 1.69%

Top 25% most likely to be exploited

Threat Score 35.7 / 100

Data Sources

NVD EPSS GitHub