CVE-2001-1524

Description

Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php.

References

http://www.securityfocus.com/bid/3609

http://www.iss.net/security_center/static/7654.php

http://prdownloads.sourceforge.net/phpnuke/PHP-Nuke-5.5.tar.gz

http://online.securityfocus.com/archive/82/246603

http://online.securityfocus.com/archive/82/243545

http://online.securityfocus.com/archive/1/245875

http://online.securityfocus.com/archive/1/245691

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3