CVE-2006-4480

CVE-2006-4480 affects Nuked-Klan 1.7 SP4.3. The issue is an incomplete blacklist in the nk_CSS function (nuked.php) that can bypass anti‑XSS protections, allowing remote attackers to inject arbitrary script/HTML via a JavaScript payload in an attribute value not covered by the blacklist (demonstr...

Nuked Klan 1.7 SP4.3 : Function Anti-XSS Bypassed

// - BEGIN - // By Blwood // http://blwood.net http://blwood.net/ We can bypassed the function anti-xss called nkCSS nuked.php using like this : b id="blwood" style="width:expressionalert' http://www.blwood.net' http://www.blwood.net272929/"/b Here is the function : function nkCSS$str if $str != ...