PT-2005-2023 · Php · Php-Nuke

Sp3X · Published 2005-04-07 · Updated 2017-07-11 · CVE-2005-1000

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters, including bid in the EmailStats operation, ratenum in the TopRated and MostPopular actions, ttitle in several actions within the Web Links module, and username in the Your Account module. API Endpoints and variables involved include:

• the bid parameter
• the ratenum parameter
• the ttitle parameter
• the username parameter.

Recommendations For PHP-Nuke version 7.6, consider disabling the vulnerable parameters bid, ratenum, ttitle, and username in their respective modules until a patch is available. Restrict access to the Web Links and Your Account modules to minimize the risk of exploitation. Avoid using the bid, ratenum, ttitle, and username parameters in the affected operations and actions until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-1000

Affected Products

Php-Nuke

References · 9

• 🔥 https://exploit-db.com/exploits/25342 · Exploit
• 🔥 https://exploit-db.com/exploits/25343 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2005-04/0037.html · Exploit
• 🔥 https://exploit-db.com/exploits/25339 · Exploit
• 🔥 https://exploit-db.com/exploits/25340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1000 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1000 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19952 · Note
• http://marc.info/?l=bugtraq&m=111263454308478&w=2 · Note