PT-2004-3257 · Phpx · Phpx

Published 2004-12-31 · Updated 2024-02-14 · CVE-2004-2363

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: PHPX versions 3.0 through 3.2.6

Description: The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags. This is achieved by bypassing the check for literal "<", ">", "(", and ")" characters in the checkURI function. Attackers can exploit this using the limit parameter to forums.php and other vectors.

Recommendations: For PHPX versions 3.0 through 3.2.6, consider disabling the checkURI function in functions.inc.php until a patch is available. Restrict access to the forums.php endpoint to minimize the risk of exploitation. Avoid using the limit parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-2363

Affected Products

Phpx

References · 6

• 🔥 http://securityfocus.com/bid/10283 · Exploit
• 🔥 https://exploit-db.com/exploits/24083 · Exploit
• 🔥 http://securityfocus.com/archive/1/362230 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2363 · Security Note
• http://phpx.org/project.php?action=view&project_id=1 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16065 · Note