CVE-2008-5039

PHP-Nuke League module - Cross-Site Scripting via tid Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-5039. PoCs published by Ehsan_Hp200.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in the PHP-Nuke Nuke League module. It explains the issue and provides a sample exploit URL but does not include actual exploit code.

Description

Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php.

Exploits (1)

exploitdb WRITEUP VERIFIED
by Ehsan_Hp200 · textwebappsphp
https://www.exploit-db.com/exploits/32538

The provided text describes a cross-site scripting (XSS) vulnerability in the PHP-Nuke Nuke League module. It explains the issue and provides a sample exploit URL but does not include actual exploit code.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Theoretical
Target: PHP-Nuke Nuke League module
No auth needed
Prerequisites: Access to the vulnerable PHP-Nuke instance
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31952
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/4575
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46154
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/497855/100/0/threaded

Scores

EPSS 0.0146
EPSS Percentile 70.1%

Details

CWE
CWE-79
Status published
Products (2)
php-nuke/league_module
php-nuke/league_module 2.4
Published Nov 12, 2008
Tracked Since Feb 18, 2026