PHPNUKE 6 XSS Vulnerabilities

From: Mark Grimes (markat_private)
Date: Tue Sep 24 2002 - 11:37:06 PDT

Next message: Matthias Bauer: "Re: PHP source injection in phpWebSite"

Previous message: Ulf H{rnhammar: "[Full-Disclosure] Re: Apache 2.0.(39|40) DOS (PHP!)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.phpnuke.org/modules.php?name=Search

Enter: ><script>alert(document.cookie);</script>
in form, click Search.

Needless to say these bugs won't go away.

The vendor WOULD HAVE been contacted if they just gave an email address
without having to subscribe to nukesupport/phpnuke - maybe I don't use it.

Likewise the author of PHP-NUKE has a submission form for bug reporting
(buried in a FAQ for unsubscribed people -- why do I need to dig for a
contact address?), but that also has a XSS vulnerability - *SIGH*
Nor HTML nor plain text will do through the submission form without the
javascript being executed or stripped.  Instead of implying &gt's and
&lt's in an email, I am posting here.

-- 
Mark Grimes <markat_private>
Stateful Labs

Next message: Matthias Bauer: "Re: PHP source injection in phpWebSite"
Previous message: Ulf H{rnhammar: "[Full-Disclosure] Re: Apache 2.0.(39|40) DOS (PHP!)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Sep 24 2002 - 12:23:49 PDT