PT-2005-2023 · Php · Php-Nuke

Sp3X · Publicado 2005-04-07 · Atualizado 2017-07-11 · CVE-2005-1000

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters, including bid in the EmailStats operation, ratenum in the TopRated and MostPopular actions, ttitle in several actions within the Web Links module, and username in the Your Account module. API Endpoints and variables involved include:

• the bid parameter
• the ratenum parameter
• the ttitle parameter
• the username parameter.

Recommendations For PHP-Nuke version 7.6, consider disabling the vulnerable parameters bid, ratenum, ttitle, and username in their respective modules until a patch is available. Restrict access to the Web Links and Your Account modules to minimize the risk of exploitation. Avoid using the bid, ratenum, ttitle, and username parameters in the affected operations and actions until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-1000

Produtos afetados

Php-Nuke

Referências · 9

• 🔥 https://exploit-db.com/exploits/25342 · Exploit
• 🔥 https://exploit-db.com/exploits/25343 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html · Exploit
• 🔥 https://exploit-db.com/exploits/25339 · Exploit
• 🔥 https://exploit-db.com/exploits/25340 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1000 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19952 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1000 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111263454308478&w=2 · Nota