PT-2004-3187 · Php · Php-Nuke

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2293

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHP-Nuke versions 6.0 through 7.3

Description: The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to multiple cross-site scripting (XSS) vulnerabilities. This can be achieved via various parameters in different modules, including the eid parameter or query parameter to the Encyclopedia module, the preview review function in the Reviews module using parameters such as url, cover, rlanguage, and hits, or the savecomment function in the Reviews module using the uname parameter.

Recommendations: For PHP-Nuke versions 6.0 through 7.3, consider disabling the Encyclopedia module and the Reviews module until a patch is available. Restrict access to the preview review and savecomment functions to minimize the risk of exploitation. Avoid using the eid, query, url, cover, rlanguage, hits, and uname parameters in the affected modules until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-2293

Affected Products

Php-Nuke

References · 10

• 🔥 http://osvdb.org/6997 · Exploit
• 🔥 http://securityfocus.com/archive/1/365865 · Exploit
• 🔥 https://exploit-db.com/exploits/24191 · Exploit
• 🔥 http://securityfocus.com/bid/10524 · Exploit
• 🔥 http://osvdb.org/6998 · Exploit
• 🔥 http://osvdb.org/6999 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2293 · Security Note
• http://secunia.com/advisories/11852 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2293 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16406 · Note