medium4.3Public exploit code
CVE-2004-2294
Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web scri…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP-Nuke 6.x/7.x Reviews Module - Multiple Cross-Site Scripting Vulnerabilities2004-06-11 · webapps · php · Verified
Impact
Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Francisco Burzi | Php-Nuke | Versions 6.0, 6.5, 6.5_beta1, 6.5_final, 6.5_rc1, 6.5_rc2 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/11852
- http://www.osvdb.org/6999
- http://www.securityfocus.com/archive/1/365865
- http://www.securityfocus.com/bid/10524
- http://secunia.com/advisories/11852
- http://www.osvdb.org/6999
- http://www.securityfocus.com/archive/1/365865
- http://www.securityfocus.com/bid/10524