PT-2005-4232 · Nuked Klan · Nuked-Klan

Papipsycho · Published 2005-11-02 · Updated 2017-07-11 · CVE-2005-3436

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nuked-Klan version 1.7

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via certain modules and fields, including the Search module, edit fields in Guestbook, the title in the Forum module, and Textbox. This could potentially lead to unauthorized actions on the affected web application.

Recommendations For Nuked-Klan version 1.7, consider disabling the Search module, restricting access to edit fields in Guestbook, limiting input in the title field of the Forum module, and avoiding the use of the Textbox until a fix is available. As a temporary workaround, restrict user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-3436

Affected Products

Nuked-Klan

References · 7

• http://secunia.com/advisories/17304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3436 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22873 · Note
• http://securityreason.com/securityalert/104 · Note
• http://vupen.com/english/advisories/2005/2189 · Note
• http://securityfocus.com/bid/15166 · Note
• http://marc.info/?l=bugtraq&m=112991421210577&w=2 · Note