Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as demonstrated using the limit parameter to forums.php and a variety of other vectors.
References
| Link | Resource |
|---|---|
| http://www.phpx.org/project.php?action=view&project_id=1 | Patch URL Repurposed |
| http://www.securityfocus.com/archive/1/362230 | Exploit Vendor Advisory |
| http://www.securityfocus.com/bid/10283 | Exploit Patch |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16065 | |
| http://www.phpx.org/project.php?action=view&project_id=1 | Patch URL Repurposed |
| http://www.securityfocus.com/archive/1/362230 | Exploit Vendor Advisory |
| http://www.securityfocus.com/bid/10283 | Exploit Patch |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16065 |
Configurations
Configuration 1 (hide)
|
History
20 Nov 2024, 23:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.phpx.org/project.php?action=view&project_id=1 - Patch, URL Repurposed | |
| References | () http://www.securityfocus.com/archive/1/362230 - Exploit, Vendor Advisory | |
| References | () http://www.securityfocus.com/bid/10283 - Exploit, Patch | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/16065 - |
14 Feb 2024, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.phpx.org/project.php?action=view&project_id=1 - Patch, URL Repurposed |
Information
Published : 2004-12-31 05:00
Updated : 2024-11-20 23:53
NVD link : CVE-2004-2363
Mitre link : CVE-2004-2363
CVE.ORG link : CVE-2004-2363
JSON object : View
Products Affected
phpx
- phpx
CWE