PT-2005-3575 · Postnuke · Postnuke

Published 2005-08-24 · Updated 2008-09-05 · CVE-2005-2689

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.760-RC4b

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the moderate parameter to the Comments module or the htmltext parameter to the html/user.php endpoint.

Recommendations For PostNuke version 0.760-RC4b, as a temporary workaround, consider restricting access to the Comments module and the html/user.php endpoint until a patch is available. Avoid using the moderate and htmltext parameters in the affected modules until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-2689

Affected Products

Postnuke

References · 5

• 🔥 https://exploit-db.com/exploits/26187 · Exploit
• 🔥 http://securityfocus.com/bid/14635 · Exploit
• 🔥 https://exploit-db.com/exploits/26188 · Exploit
• 🔥 http://securityfocus.com/archive/1/408818 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2689 · Security Note