PT-2004-1419 · Php Nuke · Php-Nuke

Publicado 2004-03-18 · Atualizado 2017-07-11 · CVE-2004-0265

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Php-Nuke versions 6.x through 7.1.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to execute arbitrary scripts as other users. This is achieved via URL-encoded title or fname parameters in the News or Reviews modules.

Recommendations For Php-Nuke versions 6.x through 7.1.0, consider disabling the News and Reviews modules until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to these modules to minimize the risk of arbitrary script execution. Avoid using the title and fname parameters in the affected modules until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2004-0265

Produtos afetados

Php-Nuke

Referências · 7

• 🔥 http://securityfocus.com/bid/9613 · Exploit
• 🔥 http://securityfocus.com/bid/9605 · Exploit
• 🔥 https://exploit-db.com/exploits/23669 · Exploit
• http://marc.info/?l=bugtraq&m=107634727520936&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0265 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15076 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0265 · Nota