PT-2004-1419 · Php Nuke · Php-Nuke

Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0265

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Php-Nuke versions 6.x through 7.1.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to execute arbitrary scripts as other users. This is achieved via URL-encoded title or fname parameters in the News or Reviews modules.

Recommendations For Php-Nuke versions 6.x through 7.1.0, consider disabling the News and Reviews modules until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to these modules to minimize the risk of arbitrary script execution. Avoid using the title and fname parameters in the affected modules until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-0265

Affected Products

Php-Nuke

References · 7

• 🔥 http://securityfocus.com/bid/9613 · Exploit
• 🔥 http://securityfocus.com/bid/9605 · Exploit
• 🔥 https://exploit-db.com/exploits/23669 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0265 · Security Note
• http://marc.info/?l=bugtraq&m=107634727520936&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15076 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0265 · Note