CVEvulnerability

CVE-2004-2363

4.3 MEDIUM Published 2004-12-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2004-12-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Validate-Before-Canonicalize vulnerability in the checkURI function in functions.inc.php in PHPX 3.0 through 3.2.6 allows remote attackers to conduct cross-site scripting (XSS) attacks via hex-encoded tags, which bypass the check for literal "<", ">", "(", and ")" characters, as demonstrated using the limit parameter to forums.php and a variety of other vectors.

Affected configurations

• phpx phpx 3.0.0 • phpx phpx 3.0.1 • phpx phpx 3.0.2 • phpx phpx 3.0.3 • phpx phpx 3.0.4 • phpx phpx 3.0.5 • phpx phpx 3.0.6 • phpx phpx 3.0.7 • phpx phpx 3.1.0 • phpx phpx 3.1.1 • phpx phpx 3.1.2 • phpx phpx 3.1.3 • phpx phpx 3.1.4 • phpx phpx 3.2.0 • phpx phpx 3.2.1 • phpx phpx 3.2.2 • phpx phpx 3.2.3 • phpx phpx 3.2.4 • phpx phpx 3.2.5 • phpx phpx 3.2.6

Related

Referenced by CWE · observed example (2)

  • CWE-179 Incorrect Behavior Order: Early Validation weakness
  • CWE-180 Incorrect Behavior Order: Validate Before Canonicalize weakness

References