CVE-2001-1524: XSS
First published: Mon Dec 31 2001(Updated: )
Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP-Nuke | =3.0 | |
| PHP-Nuke | =4.0 | |
| PHP-Nuke | =4.3 | |
| PHP-Nuke | =4.4 | |
| PHP-Nuke | =4.4.1a | |
| PHP-Nuke | =5.0 | |
| PHP-Nuke | =5.0.1 | |
| PHP-Nuke | =5.1 | |
| PHP-Nuke | =5.2 | |
| PHP-Nuke | =5.2a | |
| PHP-Nuke | =5.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://online.securityfocus.com/archive/82/243545
- http://online.securityfocus.com/archive/1/245691
- http://online.securityfocus.com/archive/1/245875
- http://online.securityfocus.com/archive/82/246603
- http://prdownloads.sourceforge.net/phpnuke/PHP-Nuke-5.5.tar.gz
- http://www.iss.net/security_center/static/7654.php
- http://www.securityfocus.com/bid/3609
Frequently Asked Questions
What is the severity of CVE-2001-1524?
CVE-2001-1524 is classified as a high severity vulnerability due to its potential for allowing remote attackers to execute arbitrary scripts.
How do I fix CVE-2001-1524?
To fix CVE-2001-1524, upgrade PHP-Nuke to version 5.3.2 or later that resolves this XSS vulnerability.
Which versions of PHP-Nuke are affected by CVE-2001-1524?
CVE-2001-1524 affects PHP-Nuke versions 5.3.1 and earlier.
What types of parameters are exploited in CVE-2001-1524?
CVE-2001-1524 exploits parameters such as uname in user.php and ttitle, letter, and file in modules.php for XSS attacks.
Can CVE-2001-1524 lead to data theft?
Yes, CVE-2001-1524 can potentially lead to data theft since it allows attackers to inject malicious scripts into web pages.
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/francisco burzi
- canonical/php-nuke
- version/php-nuke/3.0
- version/php-nuke/4.0
- version/php-nuke/4.3
- version/php-nuke/4.4
- version/php-nuke/4.4.1a
- version/php-nuke/5.0
- version/php-nuke/5.0.1
- version/php-nuke/5.1
- version/php-nuke/5.2
- version/php-nuke/5.2a
- version/php-nuke/5.3.1