CVE-2006-4480

CVE-2006-4480 affects Nuked-Klan 1.7 SP4.3. The issue is an incomplete blacklist in the nk_CSS function (nuked.php) that can bypass anti‑XSS protections, allowing remote attackers to inject arbitrary script/HTML via a JavaScript payload in an attribute value not covered by the blacklist (demonstr...

Nuked Klan 1.7 SP4.3 : Function Anti-XSS Bypassed

// - BEGIN - // By Blwood // http://blwood.net http://blwood.net/ We can bypassed the function anti-xss called nkCSS nuked.php using like this : b id="blwood" style="width:expressionalert' http://www.blwood.net' http://www.blwood.net272929/"/b Here is the function : function nkCSS$str if $str != ...

CVE-2006-4480: Undefined Security Weakness

Incomplete blacklist vulnerability in the nkCSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of...