Vulnerability CVE-2007-4212

Vulnerability CVE-2007-4212

Published: 2007-08-07 Modified: 2012-02-12

Description:

Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing "<" instead of a ">" in (1) the onerror attribute of an IMG element, (2) the onload attribute of an IFRAME element, or (3) redirect users to other sites via the META tag.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	PHP-Nuke (ALL versions) Multiple XSS and HTML injection	Mikispag	08.08.2007

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.3/10	2.9/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Phpnuke -> Php-nuke

References:

http://securityreason.com/securityalert/2974

http://www.securityfocus.com/archive/1/475249/100/0/threaded

http://www.securityfocus.com/bid/25171

Copyright 2024, cxsecurity.com