PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass

                							

                source: http://www.securityfocus.com/bid/10447/info

PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed.

This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application.

http://www.example.com/admin/case/case.adminfaq.php/admin.php?op=FaqCatGo
http://www.example.com/admin/admin.php/index.php
http://www.example.com/admin/modules/blocks.php/admin.php