Sign-up

ID

VAR-200602-0205


CVE

CVE-2006-0676


TITLE

PHPNuke Header.PHP Pagetitle Parametric Cross-Site Scripting Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200602-164

DESCRIPTION

Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter. PHPNuke is prone to a cross-site scripting vulnerability. This issue affects the 'header.php' script. PHPNuke 7.8 and prior versions are reportedly vulnerable. TITLE: PHP-Nuke "pagetitle" Cross-Site Scripting Vulnerability SECUNIA ADVISORY ID: SA18820 VERIFY ADVISORY: http://secunia.com/advisories/18820/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: >From remote SOFTWARE: PHP-Nuke 7.x http://secunia.com/product/2385/ PHP-Nuke 6.x http://secunia.com/product/329/ DESCRIPTION: Janek Vind "waraxe" has discovered a vulnerability in PHP-Nuke, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "pagetitle" parameter in "header.php" isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Example: http://[host]/?pagetitle=title</title></head><script+src=http://[host]/script.js? The vulnerability has been confirmed in version 7.8. SOLUTION: Edit the source code to ensure that input is properly sanitised. PROVIDED AND/OR DISCOVERED BY: Janek Vind "waraxe" ORIGINAL ADVISORY: http://www.waraxe.us/advisory-44.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.35

sources: NVD: CVE-2006-0676 // BID: 16608 // VULHUB: VHN-16784 // PACKETSTORM: 43777

AFFECTED PRODUCTS

vendor:francisco burzimodel:php-nukescope:eqversion:6.7

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.0

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.6

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_rc2

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_rc3

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_rc1

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_beta1

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:7.1

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:6.9

Trust: 1.6

vendor:francisco burzimodel:php-nukescope:eqversion:7.3

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:7.2

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:6.5_final

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:7.8

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:7.9

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:7.7

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:7.6

Trust: 1.0

vendor:francisco burzimodel:php-nukescope:eqversion:7.0

Trust: 1.0

vendor:franciscomodel:burzi php-nuke rc3scope:eqversion:6.5

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:6.0

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:6.5

Trust: 0.3

vendor:franciscomodel:burzi php-nuke finalscope:eqversion:7.0

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.1

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.2

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.0

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:6.7

Trust: 0.3

vendor:franciscomodel:burzi php-nuke betascope:eqversion:6.51

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.6

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.7

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.3

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:6.9

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:6.6

Trust: 0.3

vendor:franciscomodel:burzi php-nuke rc2scope:eqversion:6.5

Trust: 0.3

vendor:franciscomodel:burzi php-nuke rc1scope:eqversion:6.5

Trust: 0.3

vendor:franciscomodel:burzi php-nukescope:eqversion:7.8

Trust: 0.3

vendor:franciscomodel:burzi php-nuke finalscope:eqversion:6.5

Trust: 0.3

sources: BID: 16608 // CNNVD: CNNVD-200602-164 // NVD: CVE-2006-0676

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2006-0676
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200602-164
value: MEDIUM

Trust: 0.6

VULHUB: VHN-16784
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2006-0676
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-16784
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-16784 // CNNVD: CNNVD-200602-164 // NVD: CVE-2006-0676

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-0676

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200602-164

TYPE

xss

Trust: 0.7

sources: PACKETSTORM: 43777 // CNNVD: CNNVD-200602-164

EXTERNAL IDS

db:BIDid:16608

Trust: 2.0

db:SECUNIAid:18820

Trust: 1.8

db:VUPENid:ADV-2006-0542

Trust: 1.7

db:NVDid:CVE-2006-0676

Trust: 1.7

db:SREASONid:425

Trust: 1.7

db:CNNVDid:CNNVD-200602-164

Trust: 0.7

db:XFid:24650

Trust: 0.6

db:BUGTRAQid:20060214 [WARAXE-2006-SA#044] - XSS IN PHPNUKE 7.8 AND OLDER VERSIONS

Trust: 0.6

db:SEEBUGid:SSVID-80825

Trust: 0.1

db:EXPLOIT-DBid:27208

Trust: 0.1

db:VULHUBid:VHN-16784

Trust: 0.1

db:PACKETSTORMid:43777

Trust: 0.1

sources: VULHUB: VHN-16784 // BID: 16608 // PACKETSTORM: 43777 // CNNVD: CNNVD-200602-164 // NVD: CVE-2006-0676

REFERENCES

url:http://www.waraxe.us/advisory-44.html

Trust: 1.8

url:http://www.securityfocus.com/bid/16608

Trust: 1.7

url:http://secunia.com/advisories/18820

Trust: 1.7

url:http://securityreason.com/securityalert/425

Trust: 1.7

url:http://www.securityfocus.com/archive/1/424956/100/0/threaded

Trust: 1.1

url:http://www.vupen.com/english/advisories/2006/0542

Trust: 1.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/24650

Trust: 1.1

url:http://www.frsirt.com/english/advisories/2006/0542

Trust: 0.6

url:http://xforce.iss.net/xforce/xfdb/24650

Trust: 0.6

url:http://www.securityfocus.com/archive/1/archive/1/424956/100/0/threaded

Trust: 0.6

url:/archive/1/441490

Trust: 0.3

url:http://secunia.com/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/product/329/

Trust: 0.1

url:http://secunia.com/product/2385/

Trust: 0.1

url:http://[host]/?pagetitle=title</title></head><script+src=http://[host]/script.js?

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:http://secunia.com/advisories/18820/

Trust: 0.1

url:http://secunia.com/about_secunia_advisories/

Trust: 0.1

sources: VULHUB: VHN-16784 // BID: 16608 // PACKETSTORM: 43777 // CNNVD: CNNVD-200602-164 // NVD: CVE-2006-0676

CREDITS

Discovered by Janek Vind.

Trust: 0.9

sources: BID: 16608 // CNNVD: CNNVD-200602-164

SOURCES

db:VULHUBid:VHN-16784
db:BIDid:16608
db:PACKETSTORMid:43777
db:CNNVDid:CNNVD-200602-164
db:NVDid:CVE-2006-0676

LAST UPDATE DATE

2024-08-14T14:42:06.592000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-16784date:2018-10-19T00:00:00
db:BIDid:16608date:2006-12-13T17:08:00
db:CNNVDid:CNNVD-200602-164date:2006-02-14T00:00:00
db:NVDid:CVE-2006-0676date:2018-10-19T15:45:48.677

SOURCES RELEASE DATE

db:VULHUBid:VHN-16784date:2006-02-13T00:00:00
db:BIDid:16608date:2006-02-13T00:00:00
db:PACKETSTORMid:43777date:2006-02-13T19:29:16
db:CNNVDid:CNNVD-200602-164date:2006-02-13T00:00:00
db:NVDid:CVE-2006-0676date:2006-02-13T22:02:00