Vulnerabilities > CVE-2004-1930 - Cross-Site Scripting vulnerability in PHP-Nuke CookieDecode

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

francisco-burzi

exploit available

NVD

Published: 2004-04-12

Updated: 2017-07-11

Summary

Cross-site scripting (XSS) vulnerability in the cookiedecode function in mainfile.php for PHP-Nuke 6.x through 7.2, when themes are used, allows remote attackers to inject arbitrary web script or HTML via a base64-encoded user parameter or cookie.

Vulnerable Configurations

Part	Description	Count
Application	Francisco_Burzi Francisco Burzi PHP Nuke 6.0 Francisco Burzi PHP Nuke 6.5 Francisco Burzi PHP Nuke 6.5_Beta1 Francisco Burzi PHP Nuke 6.5_Final Francisco Burzi PHP Nuke 6.5_Rc1 Francisco Burzi PHP Nuke 6.5_Rc2 Francisco Burzi PHP Nuke 6.5_Rc3 Francisco Burzi PHP Nuke 6.6 Francisco Burzi PHP Nuke 6.7 Francisco Burzi PHP Nuke 6.9 Francisco Burzi PHP Nuke 7.0 Francisco Burzi PHP Nuke 7.0_Final Francisco Burzi PHP Nuke 7.1 Francisco Burzi PHP Nuke 7.2	14

Exploit-Db

description	PHP-Nuke 6.x/7.x CookieDecode Cross-Site Scripting Vulnerability. CVE-2004-1930. Webapps exploit for php platform
id	EDB-ID:23990
last seen	2016-02-02
modified	2004-04-13
published	2004-04-13
reporter	waraxe
source	https://www.exploit-db.com/download/23990/
title	PHP-Nuke 6.x/7.x CookieDecode Cross-Site Scripting Vulnerability

Summary

Vulnerable Configurations

Exploit-Db

References