CVE-2005-2539: XSS
First published: Wed Aug 10 2005(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) bodycolor, (2) backimage, (3) theme, or (4) logo parameter to structure.php, (5) admin, (6) admin_mail, or (7) back parameter to footer.php, or (8) the message body in a news post.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Postnuke Software Foundation Pnphpbb | =2.5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.rgod.altervista.org/flatnuke.html
- http://www.securityfocus.com/bid/14483
- http://www.osvdb.org/18551
- http://www.osvdb.org/18552
- http://www.osvdb.org/18553
- http://secunia.com/advisories/16330
- http://marc.info/?l=bugtraq&m=112327238030127&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21708
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21707
Frequently Asked Questions
What is the severity of CVE-2005-2539?
CVE-2005-2539 is classified as having a moderate severity due to its potential for cross-site scripting attacks.
How do I fix CVE-2005-2539?
To fix CVE-2005-2539, update FlatNuke to the latest version or apply security patches that address the XSS vulnerabilities.
Who is affected by CVE-2005-2539?
CVE-2005-2539 affects users of FlatNuke version 2.5.5 and possibly earlier versions.
What are the vectors for exploiting CVE-2005-2539?
CVE-2005-2539 can be exploited through parameters like bodycolor, backimage, theme, or logo in structure.php.
What kind of attacks can CVE-2005-2539 enable?
CVE-2005-2539 can enable remote attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/flatnuke
- canonical/postnuke software foundation pnphpbb
- version/postnuke software foundation pnphpbb/2.5.5