CVE-2011-1481

Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2011/03/23/8	Exploit
http://www.openwall.com/lists/oss-security/2011/03/30/7	Exploit
http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting
http://www.openwall.com/lists/oss-security/2011/03/23/8	Exploit
http://www.openwall.com/lists/oss-security/2011/03/30/7	Exploit
http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpnuke:php-nuke::::::::
	cpe:2.3:a:phpnuke:php-nuke:5.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.0.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.3.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:5.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:6.9:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.9:::::::*

History

21 Nov 2024, 01:26

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2011/03/23/8 - Exploit~~	() http://www.openwall.com/lists/oss-security/2011/03/23/8 - Exploit
References	~~() http://www.openwall.com/lists/oss-security/2011/03/30/7 - Exploit~~	() http://www.openwall.com/lists/oss-security/2011/03/30/7 - Exploit
References	~~() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting -~~	() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting -

07 Nov 2023, 02:07

Type	Values Removed	Values Added
References	{'url': 'http://yehg.net/lab/pr0js/advisories/[phpnuke-8.x]_cross_site_scripting', 'name': 'http://yehg.net/lab/pr0js/advisories/[phpnuke-8.x]_cross_site_scripting', 'tags': ['Broken Link'], 'refsource': 'MISC'}	() http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting -

Information

Published : 2011-06-21 02:52

Updated : 2024-11-21 01:26

NVD link : CVE-2011-1481

Mitre link : CVE-2011-1481

CVE.ORG link : CVE-2011-1481

JSON object : View

Products Affected

phpnuke

php-nuke

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

4.3 /10