CVE-2004-1999: XSS
Published May 5, 2004
·Updated
Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php.
Affected Software
9 affected components
Francisco Burzi PHP-Nuke=6.5
Francisco Burzi PHP-Nuke=7.0
Francisco Burzi PHP-Nuke=7.2
Francisco Burzi PHP-Nuke=6.8
Francisco Burzi PHP-Nuke=6.0
Francisco Burzi PHP-Nuke=6.7
Francisco Burzi PHP-Nuke=6.6
Francisco Burzi PHP-Nuke=6.9
Francisco Burzi PHP-Nuke=7.1
Event History
May 5, 2004
CVE Published
04:00 AM
May 10, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1999?
CVE-2004-1999 is classified as a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2004-1999?
To fix CVE-2004-1999, you should sanitize and validate the user input for the ttitle and sid parameters in the Downloads module.
3
Which versions of PHP-Nuke are affected by CVE-2004-1999?
CVE-2004-1999 affects PHP-Nuke versions 6.0 through 7.2.
4
What type of vulnerability is CVE-2004-1999?
CVE-2004-1999 is a cross-site scripting (XSS) vulnerability.
5
Can remote attackers exploit CVE-2004-1999?
Yes, remote attackers can exploit CVE-2004-1999 to inject arbitrary HTML and web scripts.