CVE-2001-0854 in PHP-Nuke
Summary
by MITRE
PHP-Nuke 5.2 allows remote attackers to copy and delete arbitrary files by calling case.filemanager.php with admin.php as an argument, which sets the $PHP_SELF variable and makes it appear that case.filemanager.php is being called by admin.php instead of the user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2025
This vulnerability exists in PHP-Nuke version 5.2 and represents a critical access control flaw that enables remote attackers to perform unauthorized file operations through manipulation of the PHP_SELF variable. The vulnerability stems from improper input validation and trust assumptions within the application's file management system, specifically when processing requests through the case.filemanager.php component. Attackers can exploit this weakness by crafting malicious requests that leverage the admin.php script as a proxy, effectively bypassing normal security controls that would typically restrict file operations to authorized administrators only.
The technical implementation of this vulnerability relies on the manipulation of the $PHP_SELF variable, which is a superglobal variable in PHP that contains the filename of the currently executing script. When an attacker calls case.filemanager.php with admin.php as an argument, the application fails to properly validate or sanitize this input, causing the $PHP_SELF variable to be set incorrectly. This misconfiguration allows the application to treat the file manager operations as if they were being executed by the administrative interface, thereby granting elevated privileges to the attacker. The vulnerability is particularly dangerous because it operates at the core level of the application's security model, where legitimate administrative functions are being impersonated through request forgery techniques.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it provides attackers with the capability to perform both read and write operations on arbitrary files within the web server's file system. This includes the potential to copy sensitive files containing database credentials, configuration settings, or other critical application data, as well as to delete essential system files that could compromise the entire application's functionality. Additionally, attackers could leverage this vulnerability to upload malicious files, potentially leading to complete system compromise through web shell deployment or other malicious payloads. The vulnerability effectively undermines the application's access control mechanisms and provides a direct pathway for privilege escalation attacks.
This vulnerability maps directly to CWE-22 known as "Improper Limitation of a Pathname to a Restricted Directory" and also relates to CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component." The attack pattern aligns with ATT&CK technique T1059.007 "Command and Scripting Interpreter: PowerShell" and T1078 "Valid Accounts" as attackers can use this vulnerability to gain access to system resources and potentially establish persistent access through file manipulation. The flaw demonstrates a classic case of insecure direct object reference where the application fails to properly validate user inputs and enforce proper access controls. Organizations should implement proper input sanitization, validate all user-supplied data, and ensure that administrative functions are properly protected through authentication and authorization checks. The vulnerability highlights the importance of maintaining proper separation between different application components and the necessity of robust input validation to prevent manipulation of critical system variables.