PT-2005-2046 · Php Nuke · Php-Nuke

Sp3X · Publicado 2005-04-09 · Atualizado 2017-07-11 · CVE-2005-1023

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 6.x through 7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to multiple cross-site scripting (XSS) vulnerabilities. This can be achieved via the min parameter to the "Search" module, the categories parameter to the "FAQ" module, or the ltr parameter to the "Encyclopedia" module.

Recommendations For PHP-Nuke versions 6.x through 7.6, consider restricting access to the vulnerable modules, specifically the Search, FAQ, and Encyclopedia modules, until a fix is available. As a temporary workaround, avoid using the min, categories, and ltr parameters in their respective modules to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-1023

Produtos afetados

Php-Nuke

Referências · 6

• 🔥 https://exploit-db.com/exploits/24190 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1023 · Nota
• http://securityreason.com/adv/PHPNuke%206.x-7.6-p1.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1023 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=111263454308478&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19952 · Nota