PT-2004-2916 · Php Nuke · Php-Nuke

Janek Vind + 1 · Published 2004-12-31 · Updated 2017-07-19 · CVE-2004-2020

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Php-Nuke versions 6.x through 7.3

Description The issue allows remote attackers to inject arbitrary HTML or web script. This can be achieved through various parameters in different modules, including the optionbox parameter in the News module, the date parameter in the Statistics module, the year, month, and month 1 parameters in the Stories Archive module, and the mode, order, and thold parameters in the Surveys module. Additionally, it is possible to inject a SQL statement to index.php, as processed by mainfile.php.

Recommendations For Php-Nuke versions 6.x through 7.3, consider disabling the vulnerable modules, such as the News, Statistics, Stories Archive, and Surveys modules, until a patch is available. Restrict access to the index.php and mainfile.php files to minimize the risk of exploitation. Avoid using the optionbox, date, year, month, month 1, mode, order, and thold parameters in the affected modules until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-2020

Affected Products

Php-Nuke

References · 9

• 🔥 http://secunia.com/advisories/11625 · Exploit
• 🔥 http://waraxe.us/index.php?modname=sa&id=29 · Exploit
• 🔥 http://securityfocus.com/bid/10367 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2020 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16172 · Note
• http://osvdb.org/6226 · Note
• http://marc.info/?l=bugtraq&m=108482957715299&w=2 · Note
• http://osvdb.org/6225 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2020 · Note