Sign-up

ID

VAR-200411-0122


CVE

CVE-2004-0265


TITLE

francisco burzi  of  php-nuke  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2004-000748

DESCRIPTION

Cross-site scripting (XSS) vulnerability in modules.php for Php-Nuke 6.x-7.1.0 allows remote attackers to execute arbitrary script as other users via URL-encoded (1) title or (2) fname parameters in the News or Reviews modules. francisco burzi of php-nuke Exists in unspecified vulnerabilities.None. It has been reported that the PHP-Nuke module 'News' is prone to a cross-site scripting vulnerability. The issue arises due to the module failing to properly sanitize user-supplied information. This could allow for execution of hostile HTML and script code in the web client of a user who visits a web page that contains the malicious code. This would occur in the security context of the site hosting the software

Trust: 2.25

sources: NVD: CVE-2004-0265 // JVNDB: JVNDB-2004-000748 // BID: 9613 // BID: 9605 // VULHUB: VHN-8695

AFFECTED PRODUCTS

vendor:francisco burzimodel:php-nukescope:eqversion:6.6

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:7.0

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:6.9

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:6.0

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:7.1

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:6.7

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:6.5

Trust: 2.4

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_rc2

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_rc3

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:7.0_final

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_final

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_rc1

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_beta1

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion: -

Trust: 0.8

vendor:francisco burzimodel:php-nukescope:eqversion:6.5 rc1

Trust: 0.8

vendor:francisco burzimodel:php-nukescope: - version: -

Trust: 0.8

vendor:francisco burzimodel:php-nukescope:eqversion:6.5 beta1

Trust: 0.8

vendor:francisco burzimodel:php-nukescope:eqversion:7.0 final

Trust: 0.8

vendor:francisco burzimodel:php-nukescope:eqversion:6.5 final

Trust: 0.8

vendor:francisco burzimodel:php-nukescope:eqversion:6.5 rc3

Trust: 0.8

vendor:francisco burzimodel:php-nukescope:eqversion:6.5 rc2

Trust: 0.8

vendor:franciscomodel:burzi php-nukescope:eqversion:7.1

Trust: 0.6

vendor:franciscomodel:burzi php-nuke finalscope:eqversion:7.0

Trust: 0.6

vendor:franciscomodel:burzi php-nukescope:eqversion:7.0

Trust: 0.6

vendor:franciscomodel:burzi php-nukescope:eqversion:6.9

Trust: 0.6

vendor:franciscomodel:burzi php-nukescope:eqversion:6.7

Trust: 0.6

vendor:franciscomodel:burzi php-nukescope:eqversion:6.6

Trust: 0.6

vendor:franciscomodel:burzi php-nuke rc3scope:eqversion:6.5

Trust: 0.6

vendor:franciscomodel:burzi php-nuke rc2scope:eqversion:6.5

Trust: 0.6

vendor:franciscomodel:burzi php-nuke rc1scope:eqversion:6.5

Trust: 0.6

vendor:franciscomodel:burzi php-nuke finalscope:eqversion:6.5

Trust: 0.6

vendor:franciscomodel:burzi php-nuke betascope:eqversion:6.51

Trust: 0.6

vendor:franciscomodel:burzi php-nukescope:eqversion:6.5

Trust: 0.6

vendor:franciscomodel:burzi php-nukescope:eqversion:6.0

Trust: 0.6

sources: BID: 9613 // BID: 9605 // JVNDB: JVNDB-2004-000748 // CNNVD: CNNVD-200411-168 // NVD: CVE-2004-0265

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-0265
value: MEDIUM

Trust: 1.0

NVD: CVE-2004-0265
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200411-168
value: MEDIUM

Trust: 0.6

VULHUB: VHN-8695
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2004-0265
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-8695
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-8695 // JVNDB: JVNDB-2004-000748 // CNNVD: CNNVD-200411-168 // NVD: CVE-2004-0265

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2004-000748 // NVD: CVE-2004-0265

THREAT TYPE

network

Trust: 0.6

sources: BID: 9613 // BID: 9605

TYPE

Input Validation Error

Trust: 0.6

sources: BID: 9613 // BID: 9605

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-8695

EXTERNAL IDS
db:NVDid:CVE-2004-0265
Trust: 3.9
db:BIDid:9605
Trust: 2.8
db:BIDid:9613
Trust: 2.8
db:JVNDBid:JVNDB-2004-000748
Trust: 0.8
db:CNNVDid:CNNVD-200411-168
Trust: 0.7
db:BUGTRAQid:20040208 [WARAXE-2004-SA#002] - CROSS-SITE SCRIPTING (XSS) IN PHP-NUKE 7.1.0
Trust: 0.6
db:XFid:15076
Trust: 0.6
db:EXPLOIT-DBid:23669
Trust: 0.1
db:SEEBUGid:SSVID-77419
Trust: 0.1
db:VULHUBid:VHN-8695
Trust: 0.1
sources:
            
            
            VULHUB: VHN-8695 // 
            
            
            
            BID: 9613 // 
            
            
            
            BID: 9605 // 
            
            
            
            JVNDB: JVNDB-2004-000748 // 
            
            
            
            CNNVD: CNNVD-200411-168 // 
            
            
            
            NVD: CVE-2004-0265

REFERENCES
url:http://www.securityfocus.com/bid/9605
Trust: 2.5
url:http://www.securityfocus.com/bid/9613
Trust: 2.5
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/15076
Trust: 1.9
url:http://marc.info/?l=bugtraq&m=107634727520936&w=2
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2004-0265
Trust: 0.8
url:/archive/1/353188
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/15076
Trust: 0.6
url:http://marc.theaimsgroup.com/?l=bugtraq&m=107634727520936&w=2
Trust: 0.6
url:http://marc.info/?l=bugtraq&m=107634727520936&w=2
Trust: 0.1
sources:
            
            
            VULHUB: VHN-8695 // 
            
            
            
            BID: 9613 // 
            
            
            
            BID: 9605 // 
            
            
            
            JVNDB: JVNDB-2004-000748 // 
            
            
            
            CNNVD: CNNVD-200411-168 // 
            
            
            
            NVD: CVE-2004-0265

CREDITS
Discovery of this issue is credited to Janek Vind <come2waraxe@yahoo.com>.
Trust: 1.2
sources:
            
            
            BID: 9613 // 
            
            
            
            BID: 9605 // 
            
            
            
            CNNVD: CNNVD-200411-168

SOURCES
db:VULHUBid:VHN-8695
db:BIDid:9613
db:BIDid:9605
db:JVNDBid:JVNDB-2004-000748
db:CNNVDid:CNNVD-200411-168
db:NVDid:CVE-2004-0265

LAST UPDATE DATE
2024-08-14T13:51:34.524000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-8695date:2017-07-11T00:00:00
db:BIDid:9613date:2009-07-12T02:06:00
db:BIDid:9605date:2009-07-12T02:06:00
db:JVNDBid:JVNDB-2004-000748date:2024-05-27T03:24:00
db:CNNVDid:CNNVD-200411-168date:2007-01-02T00:00:00
db:NVDid:CVE-2004-0265date:2017-07-11T01:30:01.307

SOURCES RELEASE DATE
db:VULHUBid:VHN-8695date:2004-11-23T00:00:00
db:BIDid:9613date:2004-02-09T00:00:00
db:BIDid:9605date:2004-02-09T00:00:00
db:JVNDBid:JVNDB-2004-000748date:2024-05-27T00:00:00
db:CNNVDid:CNNVD-200411-168date:2004-11-23T00:00:00
db:NVDid:CVE-2004-0265date:2004-11-23T05:00:00