PT-2004-3187 · Php · Php-Nuke

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2293

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHP-Nuke versions 6.0 through 7.3

Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to multiple cross-site scripting (XSS) vulnerabilities. This can be achieved via various parameters in different modules, including the eid parameter or query parameter to the Encyclopedia module, the preview review function in the Reviews module using parameters such as url, cover, rlanguage, and hits, or the savecomment function in the Reviews module using the uname parameter.

Recommendations: For PHP-Nuke versions 6.0 through 7.3, consider disabling the Encyclopedia module and the Reviews module until a patch is available. Restrict access to the preview review and savecomment functions to minimize the risk of exploitation. Avoid using the eid, query, url, cover, rlanguage, hits, and uname parameters in the affected modules until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2004-2293

Produtos afetados

Php-Nuke

Referências · 10

• 🔥 http://osvdb.org/6997 · Exploit
• 🔥 http://securityfocus.com/archive/1/365865 · Exploit
• 🔥 https://exploit-db.com/exploits/24191 · Exploit
• 🔥 http://securityfocus.com/bid/10524 · Exploit
• 🔥 http://osvdb.org/6998 · Exploit
• 🔥 http://osvdb.org/6999 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2293 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2293 · Nota
• http://secunia.com/advisories/11852 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16406 · Nota