PT-2005-2046 · Php Nuke · Php-Nuke

Sp3X · Published 2005-04-09 · Updated 2017-07-11 · CVE-2005-1023

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 6.x through 7.6

Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to multiple cross-site scripting (XSS) vulnerabilities. This can be achieved via the min parameter to the "Search" module, the categories parameter to the "FAQ" module, or the ltr parameter to the "Encyclopedia" module.

Recommendations For PHP-Nuke versions 6.x through 7.6, consider restricting access to the vulnerable modules, specifically the Search, FAQ, and Encyclopedia modules, until a fix is available. As a temporary workaround, avoid using the min, categories, and ltr parameters in their respective modules to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1023

Affected Products

Php-Nuke

References · 6

• 🔥 https://exploit-db.com/exploits/24190 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1023 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1023 · Note
• http://securityreason.com/adv/PHPNuke%206.x-7.6-p1.txt · Note
• http://marc.info/?l=bugtraq&m=111263454308478&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19952 · Note