CVE-2007-4212

Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing "<" instead of a ">" in (1) the onerror attribute of an IMG element, (2) the onload attribute of an IFRAME element, or (3) redirect users to other sites via the META tag.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/42538
http://securityreason.com/securityalert/2974
http://www.securityfocus.com/archive/1/475249/100/0/threaded
http://www.securityfocus.com/bid/25171

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpnuke:php-nuke:7.0:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.1:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.2:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.3:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.4:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.5:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.6:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.7:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.8:::::::*
	cpe:2.3:a:phpnuke:php-nuke:7.9:::::::*
	cpe:2.3:a:phpnuke:php-nuke:8.0:::::::*

History

No history.

Information

Published : 2007-08-08 02:17

Updated : 2018-10-15 21:33

NVD link : CVE-2007-4212

Mitre link : CVE-2007-4212

CVE.ORG link : CVE-2007-4212

JSON object : View

Products Affected

phpnuke

php-nuke

CWE

NVD-CWE-Other

{"id": "CVE-2007-4212", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-08-08T02:17:00.000", "references": [{"url": "http://osvdb.org/42538", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2974", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/475249/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25171", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script or HTML via a trailing \"<\" instead of a \">\" in (1) the onerror attribute of an IMG element, (2) the onload attribute of an IFRAME element, or (3) redirect users to other sites via the META tag."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el M\u00f3dulo de b\u00fasqueda de PHP-Nuke permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante un \"<\" en vez de \">\" al final de (1) el atribugo onerror de un elemento IMG, (2) el atributo onload de un elemento IFRAME, o (3) redireccionar usuarios a otros sitios mediante la etiqueta META."}], "lastModified": "2018-10-15T21:33:55.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5E8572B-43BE-4068-929F-2B6FAA9EF959"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8882C59-6721-4925-8EB6-1C54455BD03B"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C6F6110-F77B-42CE-BAD0-0AEAFC04E982"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "017A5AD3-CD1C-41E0-B53D-3881C31F7463"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68BA9153-537A-4CC5-A3E8-DE4FCF49EB52"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7481433-4DFA-4D32-BA93-FBEAC37D8D67"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85535C0D-C858-4AF8-8350-EFBF74609CBB"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CC4F979-7F10-4F0D-96AD-5EE88E437897"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A3B4A35-6019-468E-89FA-BC2EEADB7D31"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:7.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "575CFD4C-90CB-4D38-94F9-3D7915B2F054"}, {"criteria": "cpe:2.3:a:phpnuke:php-nuke:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4DB1D99-9F35-43A2-AD72-4B495B5F31BE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}