PT-2005-4948 · Php · Php-Nuke

Published 2005-12-15 · Updated 2018-10-19 · CVE-2005-4260

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke versions 7.9 and later

Description The issue is related to an interpretation conflict in the includes/mainfile.php file, which can be exploited for cross-site scripting (XSS) attacks. This is achieved by replacing the ">" in a tag with a "<", thereby bypassing the regular expressions used for data sanitization. However, many web browsers automatically correct this, potentially mitigating the issue. It is also suggested that this might be a design limitation in many web browsers rather than a vulnerability in PHP-Nuke itself.

Recommendations For PHP-Nuke versions 7.9 and later, consider implementing additional sanitization measures or input validation to prevent XSS attacks, focusing on correctly handling tags and special characters to prevent bypassing of existing security mechanisms.

Exploit

Fix

Related Identifiers

CVE-2005-4260

Affected Products

Php-Nuke

References · 6

• 🔥 http://securityfocus.com/bid/15855 · Exploit
• 🔥 https://exploit-db.com/exploits/26817 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4260 · Security Note
• http://securityfocus.com/archive/1/419991/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4260 · Note
• http://securityfocus.com/archive/1/419496/100/0/threaded · Note