PT-2005-4948 · Php · Php-Nuke

Publicado 2005-12-15 · Atualizado 2018-10-19 · CVE-2005-4260

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 7.9 and later

Description The issue is related to an interpretation conflict in the includes/mainfile.php file, which can be exploited for cross-site scripting (XSS) attacks. This is achieved by replacing the ">" in a tag with a "<", thereby bypassing the regular expressions used for data sanitization. However, many web browsers automatically correct this, potentially mitigating the issue. It is also suggested that this might be a design limitation in many web browsers rather than a vulnerability in PHP-Nuke itself.

Recommendations For PHP-Nuke versions 7.9 and later, consider implementing additional sanitization measures or input validation to prevent XSS attacks, focusing on correctly handling tags and special characters to prevent bypassing of existing security mechanisms.

Exploit

Correção

Identificadores relacionados

CVE-2005-4260

Produtos afetados

Php-Nuke

Referências · 6

• 🔥 http://securityfocus.com/bid/15855 · Exploit
• 🔥 https://exploit-db.com/exploits/26817 · Exploit
• http://securityfocus.com/archive/1/419991/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4260 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4260 · Nota de Segurança
• http://securityfocus.com/archive/1/419496/100/0/threaded · Nota