CVE-2008-4767 in DownloadsPlus module
Summary
by MITRE
Unrestricted file upload vulnerability in the DownloadsPlus module in PHP-Nuke allows remote attackers to execute arbitrary code by uploading a file with (1) .htm, (2) .html, or (3) .txt extensions, then accessing it via a direct request to the file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: it is unclear how allowing the upload of .html or .txt files supports arbitrary code execution; this might be legitimate functionality.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2025
The CVE-2008-4767 vulnerability represents a critical unrestricted file upload flaw within the DownloadsPlus module of PHP-Nuke content management system. This vulnerability classifies under CWE-434, which specifically addresses "Unrestricted Upload of File with Dangerous Type" and falls within the broader category of insecure file handling practices that have long plagued web application security frameworks. The vulnerability exists due to inadequate validation of file extensions and content types during the upload process, allowing malicious actors to bypass security measures that should prevent execution of potentially harmful files.
The technical exploitation of this vulnerability leverages the fact that the DownloadsPlus module accepts files with .htm, .html, and .txt extensions without proper sanitization or execution restriction. While the initial description suggests that the upload of these file types might appear legitimate for web content management, the vulnerability becomes dangerous when attackers upload malicious code within these seemingly benign file types. The .html and .txt extensions particularly pose risks because they can contain embedded javascript or other executable content that executes when the file is accessed through direct web requests. This creates a classic server-side file inclusion vulnerability where uploaded content becomes accessible as web-executable resources.
The operational impact of this vulnerability is severe as it enables remote code execution capabilities for attackers who can upload malicious files and subsequently access them through direct HTTP requests. This allows for complete compromise of the affected PHP-Nuke system, potentially leading to full administrative control, data exfiltration, or further network infiltration. The attack vector is straightforward - an attacker uploads a malicious file with one of the accepted extensions, then accesses it directly through the web server, bypassing normal application security controls. This vulnerability is particularly dangerous because it operates at the file system level, allowing attackers to potentially execute system commands or install backdoors that persist beyond application restarts.
The attack model aligns with several techniques documented in the MITRE ATT&CK framework, specifically relating to T1190 for Exploit Public-Facing Application and T1059 for Command and Scripting Interpreter. The vulnerability's exploitation pattern demonstrates how attackers can leverage legitimate application functionality to achieve malicious objectives, making detection more challenging. Organizations should implement comprehensive mitigation strategies including strict file extension validation, content type checking, and proper file storage isolation. The recommended approach involves rejecting file uploads with dangerous extensions, implementing proper input sanitization, and ensuring uploaded files are stored outside the web root directory with appropriate access controls. Additionally, organizations should conduct regular security assessments and maintain up-to-date vulnerability management processes to prevent exploitation of similar flaws in other components of their web infrastructure.