Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

FlatNuke 2.5.6 print.php can expose paths or crash site

CVE-2005-2815 · published 21 years ago
Summary

The print.php page in FlatNuke version 2.5.6 can reveal where files are stored on the server or make the site unresponsive when specially crafted names like AUX, CON, PRN, COM1 or LPT1 are used. This happens because the script improperly handles those names, which are reserved on older Windows systems. Update to a newer FlatNuke release or apply a patch that validates input to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
flatnuke flatnuke 2.5.6
cpe:2.3:a:flatnuke:flatnuke:2.5.6:*:*:*:*:*:*:*
Original advisory text
print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information (path disclosure on error) or cause a denial of service (resource consumption) via an MS-DOS device name in the n...
print.php in FlatNuke 2.5.6 allows remote attackers to obtain sensitive information (path disclosure on error) or cause a denial of service (resource consumption) via an MS-DOS device name in the news parameter to print.php, such as (1) AUX, (2) CON, (3) PRN, (4) COM1, or (5) LPT1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published7 Sep 2005
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-2815 · NVD
Track software like this
Free during beta