Vulnerabilities > CVE-2004-2294 - Unspecified vulnerability in Francisco Burzi PHP-Nuke

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

francisco-burzi

exploit available

NVD

Published: 2004-12-31

Updated: 2024-11-20

Summary

Canonicalize-before-filter error in the send_review function in the Reviews module for PHP-Nuke 6.0 to 7.3 allows remote attackers to inject arbitrary web script or HTML via hex-encoded XSS sequences in the text parameter, which is checked for dangerous sequences before it is canonicalized, leading to a cross-site scripting (XSS) vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Francisco_Burzi Francisco Burzi PHP Nuke 6.5_Beta1 Francisco Burzi PHP Nuke 6.5 Francisco Burzi PHP Nuke 7.0 Francisco Burzi PHP Nuke 7.2 Francisco Burzi PHP Nuke 7.0_Final Francisco Burzi PHP Nuke 6.5_Rc2 Francisco Burzi PHP Nuke 7.3 Francisco Burzi PHP Nuke 6.5_Final Francisco Burzi PHP Nuke 6.5_Rc1 Francisco Burzi PHP Nuke 6.5_Rc3 Francisco Burzi PHP Nuke 7.1 Francisco Burzi PHP Nuke 6.0 Francisco Burzi PHP Nuke 6.6 Francisco Burzi PHP Nuke 6.9 Francisco Burzi PHP Nuke 6.7	15

Exploit-Db

description	PHP-Nuke 6.x/7.x Reviews Module Multiple Parameter XSS. CVE-2004-2294. Webapps exploit for php platform
id	EDB-ID:24194
last seen	2016-02-02
modified	2004-06-11
published	2004-06-11
reporter	Janek Vind
source	https://www.exploit-db.com/download/24194/
title	PHP-Nuke 6.x/7.x Reviews Module Multiple Parameter XSS

Summary

Vulnerable Configurations

Exploit-Db

References