PT-2001-2609 · Php · Php-Nuke

Publicado 2001-12-31 · Atualizado 2008-09-10 · CVE-2001-1524

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 5.3.1 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including uname in "user.php", ttitle, letter, and file in "modules.php", subject, story, and storyext in "submit.php", upload in "admin.php", and fname in "friend.php".

Recommendations For PHP-Nuke versions 5.3.1 and earlier, consider disabling the affected parameters, such as uname, ttitle, letter, file, subject, story, storyext, upload, and fname, in their respective files until a patch is available. Restrict access to the vulnerable modules and files, such as "user.php", "modules.php", "submit.php", "admin.php", and "friend.php", to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2001-1524

Produtos afetados

Php-Nuke

Referências · 11

• 🔥 https://exploit-db.com/exploits/21165 · Exploit
• 🔥 https://exploit-db.com/exploits/21166 · Exploit
• http://online.securityfocus.com/archive/82/246603 · Nota
• http://iss.net/security_center/static/7654.php · Nota
• http://online.securityfocus.com/archive/82/243545 · Nota
• http://online.securityfocus.com/archive/1/245875 · Nota
• http://prdownloads.sourceforge.net/phpnuke/PHP-Nuke-5.5.tar.gz · Correção
• http://securityfocus.com/bid/3609 · Nota
• http://online.securityfocus.com/archive/1/245691 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2001-1524 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1524 · Nota