CVE-2004-2363

Опубликовано: 31 дек. 2004

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as demonstrated using the limit parameter to forums.php and a variety of other vectors.

Ссылки

http://www.phpx.org/project.php?action=view&project_id=1
Patch
URL Repurposed
http://www.securityfocus.com/archive/1/362230
Exploit
Vendor Advisory
http://www.securityfocus.com/bid/10283
Exploit
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16065
http://www.phpx.org/project.php?action=view&project_id=1
Patch
URL Repurposed
http://www.securityfocus.com/archive/1/362230
Exploit
Vendor Advisory
http://www.securityfocus.com/bid/10283
Exploit
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/16065

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:phpx:phpx:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.1:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.2:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.5:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.6:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.0.7:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.1.1:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.1.2:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.1.3:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.1.4:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.3:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.4:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.5:*:*:*:*:*:*:*

cpe:2.3:a:phpx:phpx:3.2.6:*:*:*:*:*:*:*

EPSS

Процентиль: 70%

0.00646

Низкий

4.3 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-rw32-jvhw-2fm9

github

почти 4 года назад