PHP-Nuke Web Mail Script Injection Vulnerability

Bugtraq ID:	6400
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2002 12:00AM
Updated:	Dec 16 2002 12:00AM
Credit:	Discovery of this vulnerability is credited to Ulf Harnhammer.
Vulnerable:	Francisco Burzi PHP-Nuke 6.0
Not Vulnerable:

PHP-Nuke Web Mail Script Injection Vulnerability

A vulnerability has been discovered in the PHP-Nuke web mail module. Due to insufficient sanitization of HTML emails it is possible for an attacker to embed script code into malicious messages. Opening an email containing attacker-supplied script code would result in the execution of arbitrary script code within the client's browser.

PHP-Nuke Web Mail Script Injection Vulnerability

The following exploit was provided:

• /data/vulnerabilities/patches/php-nuke_webmail.zip

PHP-Nuke Web Mail Script Injection Vulnerability

Solution:
An unofficial patch has been released by Ulf Harnhammer.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.


Francisco Burzi PHP-Nuke 6.0

• Ulf Harnhammer php-nuke_webmail.zip
  http://downloads.securityfocus.com/vulnerabilities/patches/php-nuke_we bmail.zip