WarpSpeed 4nAlbum Module 0.92 - nmimage.php?z Cross-Site Scripting

2004-03-15T00:00:00
ID EXPLOITPACK:03A701372CFC03210EC6DE41B10279A0
Type exploitpack
Reporter Janek Vind
Modified 2004-03-15T00:00:00

Description

WarpSpeed 4nAlbum Module 0.92 - nmimage.php?z Cross-Site Scripting

                                        
                                            source: https://www.securityfocus.com/bid/9881/info
 
It has been reported that 4nAlbum is prone to multiple vulnerabilities. These issues are primarily due to a failure of the module to validate user input.
 
There is an information disclosure issue with the 'displaycategory.php' script.
 
There is a remote file inclusion vulnerability in the 'displaycategory.php' script.
 
A cross-site scripting vulnerability in the 'nmimage.php' script has also been reported.
 
Finally an SQL injection vulnerability has been reported. This issue may be leveraged through the 'modules.php' script of phpNuke while requesting the 'index' file of the 4nAlbum module.
 
This issue has been reported to affect version 0.92 of the software. It is quite likely that other versions are affected as well.

http://www.example.com/phpNukeDirectory/modules/4nalbum/public/nmimage.php?z=[xss code here]