Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability.
References
| Link | Resource |
|---|---|
| http://secunia.com/advisories/11852 | Vendor Advisory |
| http://www.osvdb.org/6999 | Exploit |
| http://www.securityfocus.com/archive/1/365865 | Exploit |
| http://www.securityfocus.com/bid/10524 | Exploit |
| http://secunia.com/advisories/11852 | Vendor Advisory |
| http://www.osvdb.org/6999 | Exploit |
| http://www.securityfocus.com/archive/1/365865 | Exploit |
| http://www.securityfocus.com/bid/10524 | Exploit |
Configurations
Configuration 1 (hide)
|
History
20 Nov 2024, 23:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://secunia.com/advisories/11852 - Vendor Advisory | |
| References | () http://www.osvdb.org/6999 - Exploit | |
| References | () http://www.securityfocus.com/archive/1/365865 - Exploit | |
| References | () http://www.securityfocus.com/bid/10524 - Exploit |
Information
Published : 2004-12-31 05:00
Updated : 2024-11-20 23:52
NVD link : CVE-2004-2294
Mitre link : CVE-2004-2294
CVE.ORG link : CVE-2004-2294
JSON object : View
Products Affected
francisco_burzi
- php-nuke
CWE