PT-2005-4232 · Nuked Klan · Nuked-Klan

Papipsycho · Publicado 2005-11-02 · Atualizado 2017-07-11 · CVE-2005-3436

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nuked-Klan version 1.7

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via certain modules and fields, including the Search module, edit fields in Guestbook, the title in the Forum module, and Textbox. This could potentially lead to unauthorized actions on the affected web application.

Recommendations For Nuked-Klan version 1.7, consider disabling the Search module, restricting access to edit fields in Guestbook, limiting input in the title field of the Forum module, and avoiding the use of the Textbox until a fix is available. As a temporary workaround, restrict user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-3436

Produtos afetados

Nuked-Klan

Referências · 7

• http://secunia.com/advisories/17304 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22873 · Nota
• http://securityreason.com/securityalert/104 · Nota
• http://vupen.com/english/advisories/2005/2189 · Nota
• http://securityfocus.com/bid/15166 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3436 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=112991421210577&w=2 · Nota