CVE-2001-1524: XSS

Published Dec 31, 2001

Updated

Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php.

Affected Software

11 affected components

Francisco Burzi PHP-Nuke=4.0

Francisco Burzi PHP-Nuke=5.3.1

Francisco Burzi PHP-Nuke=5.1

Francisco Burzi PHP-Nuke=4.3

Francisco Burzi PHP-Nuke=4.4

Francisco Burzi PHP-Nuke=3.0

Francisco Burzi PHP-Nuke=5.0

Francisco Burzi PHP-Nuke=5.2a

Francisco Burzi PHP-Nuke=5.0.1

Francisco Burzi PHP-Nuke=5.2

Francisco Burzi PHP-Nuke=4.4.1a

Remediation

Patch Available

http://prdownloads.sourceforge.net/phpnuke/PHP-Nuke-5.5.tar.gz

Event History

Dec 31, 2001

CVE Published

05:00 AM

Jul 14, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1524?

CVE-2001-1524 is classified as a high severity vulnerability due to its potential for allowing remote attackers to execute arbitrary scripts.

How do I fix CVE-2001-1524?

To fix CVE-2001-1524, upgrade PHP-Nuke to version 5.3.2 or later that resolves this XSS vulnerability.

Which versions of PHP-Nuke are affected by CVE-2001-1524?

CVE-2001-1524 affects PHP-Nuke versions 5.3.1 and earlier.

What types of parameters are exploited in CVE-2001-1524?

CVE-2001-1524 exploits parameters such as uname in user.php and ttitle, letter, and file in modules.php for XSS attacks.

Can CVE-2001-1524 lead to data theft?

Yes, CVE-2001-1524 can potentially lead to data theft since it allows attackers to inject malicious scripts into web pages.