CVE-2004-2020: XSS

Published Dec 31, 2004

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Php-Nuke 6.x through 7.3 allow remote attackers to inject arbitrary HTML or web script into the (1) optionbox parameter in the News module, (2) date parameter in the Statistics module, (3) year, month, and month1 parameters in the StoriesArchive module, (4) mode, order, and thold parameters in the Surveys module, or (5) a SQL statement to index.php, as processed by mainfile.php.

Affected Software

15 affected components

Francisco Burzi PHP-Nuke=6.0

Francisco Burzi PHP-Nuke=6.5

Francisco Burzi PHP-Nuke=6.5_beta1

Francisco Burzi PHP-Nuke=6.5_final

Francisco Burzi PHP-Nuke=6.5_rc1

Francisco Burzi PHP-Nuke=6.5_rc2

Francisco Burzi PHP-Nuke=6.5_rc3

Francisco Burzi PHP-Nuke=6.6

Francisco Burzi PHP-Nuke=6.7

Francisco Burzi PHP-Nuke=6.9

Francisco Burzi PHP-Nuke=7.0

Francisco Burzi PHP-Nuke=7.0_final

Francisco Burzi PHP-Nuke=7.1

Francisco Burzi PHP-Nuke=7.2

Francisco Burzi PHP-Nuke=7.3

Event History

Dec 31, 2004

CVE Published

05:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2020?

CVE-2004-2020 is considered a high severity vulnerability due to its potential for remote attackers to execute arbitrary scripts.

How do I fix CVE-2004-2020?

To fix CVE-2004-2020, update Php-Nuke to a version that is not vulnerable, such as 7.4 or later.

What software is affected by CVE-2004-2020?

CVE-2004-2020 affects Php-Nuke versions 6.0 to 7.3.

What type of vulnerability is CVE-2004-2020?

CVE-2004-2020 is a cross-site scripting (XSS) vulnerability.

Can CVE-2004-2020 be exploited without authentication?

Yes, CVE-2004-2020 can be exploited by remote attackers without requiring authentication.