PostNuke Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	14635
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 22 2005 12:00AM
Updated:	Aug 22 2005 12:00AM
Credit:	Maksymilian Arciemowicz is credited with the discovery of this vulnerability.
Vulnerable:	PostNuke Development Team PostNuke 0.76 RC4b
Not Vulnerable:

PostNuke Multiple Cross Site Scripting Vulnerabilities

PostNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.

This can lead to theft of cookie-based authentication credentials, as well as other types of attacks.

PostNuke Multiple Cross Site Scripting Vulnerabilities

No exploit is required.

Sample exploit URI have been provided:
http://www.example.com/[DIR]/index.php?module=Comments&req=moderate&moderate=<center><h1>xss
http://www.example.com/PostNuke-0.760-RC4b/html/user.php?op=edituser&htmltext=<h1>xss

PostNuke Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PostNuke Multiple Cross Site Scripting Vulnerabilities

References:

• PostNuke Homepage (PostNuke Development Team)
  
• Multiple vulnerabilities in PostNuke 0.760-RC4b=>x cXIb8O3.15 (Maksymilian Arciemowicz )