PT-2005-2050 · Php · Php-Nuke

Sp3X · Publicado 2005-04-09 · Atualizado 2017-07-11 · CVE-2005-1027

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 6.x through 7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the username parameter in the "Your Account" module, the avatarcategory parameter in the "Your Account" module, or the lid parameter in the "Downloads" module.

Recommendations For PHP-Nuke versions 6.x through 7.6, consider disabling the affected modules, specifically the "Your Account" and "Downloads" modules, until a fix is available. Restrict access to the username, avatarcategory, and lid parameters in the respective modules to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2005-1027

Produtos afetados

Php-Nuke

Referências · 7

• 🔥 https://exploit-db.com/exploits/25341 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1027 · Nota
• http://marc.info/?l=bugtraq&m=111272010303144&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11994 · Nota
• http://securityfocus.com/archive/1/321324 · Nota
• http://securityfocus.com/bid/7570 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1027 · Nota de Segurança