Php-Nuke CVE-2011-1481 Cross-Site Scripting Vulnerability

Bugtraq ID:	73824
Class:	Input Validation Error
CVE:	CVE-2011-1481
Remote:	Yes
Local:	No
Published:	Jun 20 2011 12:00AM
Updated:	Jun 20 2011 12:00AM
Credit:	Unknown
Vulnerable:	Phpnuke Php-Nuke 6.9 Phpnuke Php-Nuke 6.8 Phpnuke Php-Nuke 6.7 Phpnuke Php-Nuke 6.6 Phpnuke Php-Nuke 6.0 Phpnuke Php-Nuke 5.5 Phpnuke Php-Nuke 5.4 Phpnuke Php-Nuke 5.3.1 Phpnuke Php-Nuke 5.3 Phpnuke Php-Nuke 5.2 Phpnuke Php-Nuke 5.1 Phpnuke Php-Nuke 5.0.1 Phpnuke Php-Nuke 5.0 PHP-Nuke PHP-Nuke 7.9 PHP-Nuke PHP-Nuke 7.8 PHP-Nuke PHP-Nuke 7.7 PHP-Nuke PHP-Nuke 7.6 PHP-Nuke PHP-Nuke 7.5 PHP-Nuke PHP-Nuke 7.4 PHP-Nuke PHP-Nuke 7.3 PHP-Nuke PHP-Nuke 7.2 PHP-Nuke PHP-Nuke 7.1 PHP-Nuke PHP-Nuke 7.0
Not Vulnerable:

Php-Nuke CVE-2011-1481 Cross-Site Scripting Vulnerability

Php-Nuke is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.

Php-Nuke CVE-2011-1481 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Php-Nuke CVE-2011-1481 Cross-Site Scripting Vulnerability

References:

• http://yehg.net/lab/pr0js/advisories/%5Bphpnuke-8.x%5D_cross_site_scripting (MISC)
  
• oss-security - CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability (MLIST)
  
• oss-security - Re: CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerabi (MLIST)