Vulnerability Name:

CVE-2004-1999 (CCN-16073)

Assigned:2004-05-05
Published:2004-05-05
Updated:2017-07-11
Summary:Cross-site scripting (XSS) vulnerability in the Downloads module in Php-Nuke 6.x through 7.2 allows remote attackers to inject arbitrary HTML and web script via the (1) ttitle or (2) sid parameters to modules.php.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: BugTraq Mailing List, Wed May 05 2004 - 11:02:39 CDT
waraxe-2004-SA#027 - Once again - critical vulnerabilities in PhpNuke 6.x - 7.2

Source: MITRE
Type: CNA
CVE-2004-1999

Source: BUGTRAQ
Type: UNKNOWN
20040505 [waraxe-2004-SA#027 - Once again - critical vulnerabilities in PhpNuke 6.x - 7.2]

Source: CCN
Type: SA11553
PHP-Nuke Multiple Vulnerabilities

Source: SECUNIA
Type: Exploit, Vendor Advisory
11553

Source: CCN
Type: OSVDB ID: 5914
PHP-Nuke Downloads Module Multiple Parameter XSS

Source: MISC
Type: Exploit, Vendor Advisory
http://www.waraxe.us/index.php?modname=sa&id=27

Source: XF
Type: UNKNOWN
phpnuke-title-sid-xss(16073)

Source: XF
Type: UNKNOWN
phpnuke-ttitle-sid-xss(16073)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:francisco_burzi:php-nuke:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:6.5:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:6.6:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:6.7:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:6.8:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:6.9:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:francisco_burzi:php-nuke:7.2:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:phpnuke:php-nuke:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:6.7:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:6.5:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:7.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:6.6:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:6.9:*:*:*:*:*:*:*
  • OR cpe:/a:phpnuke:php-nuke:6.8:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    francisco_burzi php-nuke 6.0
    francisco_burzi php-nuke 6.5
    francisco_burzi php-nuke 6.6
    francisco_burzi php-nuke 6.7
    francisco_burzi php-nuke 6.8
    francisco_burzi php-nuke 6.9
    francisco_burzi php-nuke 7.0
    francisco_burzi php-nuke 7.1
    francisco_burzi php-nuke 7.2
    phpnuke php-nuke 6.0
    phpnuke php-nuke 6.7
    phpnuke php-nuke 7.0
    phpnuke php-nuke 6.5
    phpnuke php-nuke 7.1
    phpnuke php-nuke 7.2
    phpnuke php-nuke 6.6
    phpnuke php-nuke 6.9
    phpnuke php-nuke 6.8