NukeET 3.0/3.1 - Base64 Codigo Variable Cross-Site Scripting
| Reporter | Title | Published | Views | Family All 4 |
|---|---|---|---|---|
 | CVE-2005-1610 | 16 May 200504:00 | – | cve |
 | CVE-2005-1610 | 16 May 200504:00 | – | cvelist |
 | EUVD-2005-1613 | 7 Oct 202500:30 | – | euvd |
 | CVE-2005-1610 | 16 May 200504:00 | – | nvd |
source: https://www.securityfocus.com/bid/13570/info
NukeET is prone to a cross-site scripting vulnerability.
The source of this issue is that HTML and script code is not properly sanitized from URI variables before being output in a dynamically generated Web page. However, to successfully trigger the issue, HTML and script code may be Base64-encoded when passed as a URI variable argument.
An attacker may exploit the issue by enticing a user to following a link that includes hostile Base64-encoded HTML and script code. The malicious input will be decoded by the application and may then be rendered in the browser of the user who visits the link.
The following Base64-encoded string is equivalent to <script>alert()</script><h1>XSS PoW@ !!!</h1>:
PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+
http://www.example.com/security.php?codigo=
PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 May 2013 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 26.8
EPSS0.02252