PT-2008-2126 · Nucleus · Nucleus Cms

Published 2008-01-30 · Updated 2018-10-15 · CVE-2008-0497

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nucleus CMS version 3.31

Description A cross-site scripting (XSS) issue exists due to insufficient quoting of the PATH INFO when processing PHP SELF, allowing remote attackers to inject arbitrary web script or HTML.

Recommendations For Nucleus CMS version 3.31, update the action.php file to properly quote the PATH INFO when processing PHP SELF to prevent XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0497

Affected Products

Nucleus Cms

References · 11

• 🔥 https://exploit-db.com/exploits/31074 · Exploit
• http://sourceforge.net/project/shownotes.php?group_id=66479&release_id=572117 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-0497 · Security Note
• http://nucleuscms.org/item/3047 · Note
• http://vupen.com/english/advisories/2008/0369 · Note
• http://securityfocus.com/archive/1/487255/100/0/threaded · Note
• http://securityreason.com/securityalert/3593 · Note
• http://secunia.com/advisories/28680 · Note
• http://securityfocus.com/archive/1/487252/100/0/threaded · Note
• http://securityfocus.com/bid/27492 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0497 · Note