Executive Summary

Informations
Name CVE-2004-2363 First vendor Publication 2004-12-31
Vendor Cve Last vendor Modification 2024-02-14

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as demonstrated using the limit parameter to forums.php and a variety of other vectors.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2363

CAPEC : Common Attack Pattern Enumeration & Classification

Id Name
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-4 Using Alternative IP Address Encodings
CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
CAPEC-78 Using Escaped Slashes in Alternate Encoding
CAPEC-79 Using Slashes in Alternate Encoding
CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic

CWE : Common Weakness Enumeration

% Id Name

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 20

Open Source Vulnerability Database (OSVDB)

Id Description
5903 PHPX forums.php Multiple Parameter XSS

PHPX contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate multiple variables upon submission to the "forums.php" script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/10283
BUGTRAQ http://www.securityfocus.com/archive/1/362230
MISC http://www.phpx.org/project.php?action=view&project_id=1
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/16065

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
Date Informations
2024-02-14 13:28:32
  • Multiple Updates
2021-05-04 12:02:37
  • Multiple Updates
2021-04-22 01:02:49
  • Multiple Updates
2020-05-23 00:16:10
  • Multiple Updates
2018-07-13 01:01:55
  • Multiple Updates
2017-07-11 12:01:43
  • Multiple Updates
2013-05-11 11:48:43
  • Multiple Updates