CVE-2005-1000 in PHP-Nuke
Summary
by MITRE
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Nuke 7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the bid parameter to the EmailStats op in banners.pgp, (2) the ratenum parameter in the TopRated and MostPopular actions in the Web_Links module, (3) the ttitle parameter in the viewlinkdetails, viewlinkeditorial, viewlinkcomments, and ratelink actions in the Web_Links module, or (4) the username parameter in the Your_Account module.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2025
The vulnerability identified as CVE-2005-1000 represents a critical cross-site scripting flaw affecting PHP-Nuke version 7.6, a widely deployed content management system and web application framework. This vulnerability stems from insufficient input validation and output sanitization mechanisms within the application's core modules, specifically targeting parameters within the banners, web links, and user account functionalities. The flaw enables remote attackers to inject malicious scripts into web pages viewed by other users, creating a persistent security risk that can compromise user sessions and data integrity. The vulnerability manifests across multiple attack vectors within the application's architecture, demonstrating a systemic weakness in input handling that affects several core modules simultaneously.
The technical exploitation of this vulnerability occurs through four distinct parameter injection points that bypass the application's security controls. The bid parameter in the EmailStats operation within banners.pgp allows attackers to inject malicious content through banner identification numbers, while the ratenum parameter in both TopRated and MostPopular actions within the Web_Links module creates opportunities for script injection during link rating operations. Additionally, the ttitle parameter in various Web_Links actions including viewlinkdetails, viewlinkeditorial, viewlinkcomments, and ratelink provides another injection point where attacker-controlled titles can contain malicious scripts. The username parameter within the Your_Account module represents a fourth vector where user registration or profile modification operations can be exploited. These attack vectors align with CWE-79, which specifically addresses Cross-Site Scripting vulnerabilities, and demonstrate how insufficient input validation creates multiple entry points for malicious code execution.
The operational impact of CVE-2005-1000 extends beyond simple script injection, potentially enabling attackers to perform session hijacking, steal user credentials, redirect users to malicious sites, or execute unauthorized actions on behalf of victims. When exploited, these vulnerabilities can lead to complete compromise of user accounts within the PHP-Nuke application, as the injected scripts execute within the context of authenticated user sessions. The widespread use of PHP-Nuke 7.6 in web applications meant that successful exploitation could affect numerous websites simultaneously, creating a significant risk for organizations relying on this platform for their online presence. The vulnerability's persistence stems from the fact that the malicious scripts are stored within the application's database and executed every time affected pages are accessed, making it particularly dangerous for long-term compromise.
Organizations affected by this vulnerability should implement immediate mitigations including input validation at multiple layers, output encoding for all dynamic content, and comprehensive parameter sanitization across all affected modules. The recommended approach involves implementing strict validation rules for all user-supplied input, particularly for the identified parameter names, and ensuring that all output is properly escaped to prevent script execution. Security controls should be implemented at the application level through proper parameter validation and input sanitization, as well as at the network level through web application firewalls that can detect and block malicious script injection attempts. This vulnerability demonstrates the critical importance of following secure coding practices and adhering to the principle of least privilege in web application development, with specific relevance to the ATT&CK framework's mitigation strategies for command and control operations through web application vulnerabilities. The incident underscores the necessity of regular security assessments and input validation testing to prevent similar vulnerabilities from being introduced in future versions of the software.