PHPNuke 5 Cross Scripting

From: Replugge [Rod] (repluggeat_private)
Date: Mon Dec 17 2001 - 04:30:38 PST

Next message: Jake: "Re: wmcube-gdk is vulnerable to a local exploit"

Previous message: IT Resource Center : "HP Secure OS Software for Linux security bulletins digest"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This is a forward of frog-m@n posting to Vuln-Dev.


Here a few holes that i've found in PHPNuke.
     5 "Cross Site Scripting".

     http://phpnuke.org/modules.php?
     name=Downloads&d_op=viewdownloaddetails&lid=0
     2&ttitle=[JAVASCRIPT]

     http://phpnuke.org/modules.php?
     name=Downloads&d_op=ratedownload&lid=118&ttitle
     =[JAVASCRIPT]

     http://phpnuke.org/modules.php?
     op=modload&name=Members_List&file=index&letter
     =[JAVASCRIPT]

     http://phpnuke.org/submit.php?subject=
     [JAVASCRIPT]&story=[JAVASCRIPT]&storyext=
     [JAVASCRIPT]&op=Preview

     http://phpnuke.org/user.php?op=userinfo&uname=
     [JAVASCRIPT]


     and /admin.php?upload=Go! who's the same that 
     upload=1 .

     frog-m@n

--
/* 
Rodrigo Gutierrez <rodrigoat_private>
Trustix AS - http://www.trustix.com 
*/

Next message: Jake: "Re: wmcube-gdk is vulnerable to a local exploit"
Previous message: IT Resource Center : "HP Secure OS Software for Linux security bulletins digest"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Dec 19 2001 - 12:57:54 PST