PHPNuke Header.PHP Pagetitle Parameter Cross-Site Scripting Vulnerability
BID:16608
Info
PHPNuke Header.PHP Pagetitle Parameter Cross-Site Scripting Vulnerability
| Bugtraq ID: | 16608 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2006 12:00AM |
| Updated: | Dec 13 2006 05:08PM |
| Credit: | Discovered by Janek Vind. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 7.8 Francisco Burzi PHP-Nuke 7.7 Francisco Burzi PHP-Nuke 7.6 Francisco Burzi PHP-Nuke 7.3 Francisco Burzi PHP-Nuke 7.3 Francisco Burzi PHP-Nuke 7.2 Francisco Burzi PHP-Nuke 7.1 Francisco Burzi PHP-Nuke 7.0 FINAL Francisco Burzi PHP-Nuke 7.0 Francisco Burzi PHP-Nuke 6.9 Francisco Burzi PHP-Nuke 6.7 Francisco Burzi PHP-Nuke 6.6 Francisco Burzi PHP-Nuke 6.5 RC3 Francisco Burzi PHP-Nuke 6.5 RC2 Francisco Burzi PHP-Nuke 6.5 RC1 Francisco Burzi PHP-Nuke 6.5 FINAL Francisco Burzi PHP-Nuke 6.5 BETA 1 Francisco Burzi PHP-Nuke 6.5 Francisco Burzi PHP-Nuke 6.0 |
| Not Vulnerable: | |
Discussion
PHPNuke Header.PHP Pagetitle Parameter Cross-Site Scripting Vulnerability
PHPNuke is prone to a cross-site scripting vulnerability.
This issue affects the 'header.php' script.
PHPNuke 7.8 and prior versions are reportedly vulnerable.
PHPNuke is prone to a cross-site scripting vulnerability.
This issue affects the 'header.php' script.
PHPNuke 7.8 and prior versions are reportedly vulnerable.
Exploit / POC
PHPNuke Header.PHP Pagetitle Parameter Cross-Site Scripting Vulnerability
An exploit is not required.
The following proof of concept was provided:
http://www.example.com/nuke78/?pagetitle=w00t></title></head><body>test
An exploit is not required.
The following proof of concept was provided:
http://www.example.com/nuke78/?pagetitle=w00t></title></head><body>test
Solution / Fix
PHPNuke Header.PHP Pagetitle Parameter Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
References
PHPNuke Header.PHP Pagetitle Parameter Cross-Site Scripting Vulnerability
References:
References:
- PHP-Nuke INP XSS (l2odon)