PT-2006-2836 · Php Nuke · Php-Nuke

Published 2006-04-19 · Updated 2011-03-08 · CVE-2006-1846

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP-Nuke version 7.8

Description A cross-site scripting (XSS) issue might exist in the Your Account module, potentially allowing remote attackers to inject arbitrary HTML and web script via the ublock parameter. This parameter is saved in the user's personal menu. The details of this issue are based on third-party information, and it is unclear whether this is a genuine vulnerability, given its relation to the user's personal menu, which is presumably not modifiable by others.

Recommendations For PHP-Nuke version 7.8, consider restricting the use of the ublock parameter in the Your Account module until more information is available about this issue. As a temporary workaround, avoid using the ublock parameter to minimize the risk of potential exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2006-1846

Affected Products

Php-Nuke

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-1846 · Security Note
• http://secunia.com/advisories/18972 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1846 · Note
• http://vupen.com/english/advisories/2006/0687 · Note
• http://osvdb.org/23431 · Note
• http://securityfocus.com/bid/16774 · Note