Vulnerability CVE-2006-4480

Vulnerability CVE-2006-4480

Published: 2006-08-31 Modified: 2012-02-12

Description:

Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Nuked Klan 1.7 SP4.3 : Function Anti-XSS Bypassed	Blwood (blwood s...	02.09.2006

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Nuked-klan -> Nuked-klan

References:

http://securityreason.com/securityalert/1478

http://www.securityfocus.com/archive/1/444749/100/0/threaded

Copyright 2024, cxsecurity.com