PHP-Nuke 6.0 Multiple Cross Site Scripting Vulnerabilities
BID:6409
Info
PHP-Nuke 6.0 Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 6409 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2002 12:00AM |
| Updated: | Dec 16 2002 12:00AM |
| Credit: | Discovery of this vulnerability is credited to "Frog Man" <[email protected]> of phpsecure. |
| Vulnerable: |
Francisco Burzi PHP-Nuke 6.0 |
| Not Vulnerable: | |
Discussion
PHP-Nuke 6.0 Multiple Cross Site Scripting Vulnerabilities
It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for script code to be embedded in PHP script requests.
By constructing a malicious link which exploits one of these vulnerabilities, it may be possible to execute arbitrary code within the context of a website visited by an unsuspecting user. This may allow a remote attacker to steal cookie-based authentication credentials, which could be used at a later time to hijack a users web session.
It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for script code to be embedded in PHP script requests.
By constructing a malicious link which exploits one of these vulnerabilities, it may be possible to execute arbitrary code within the context of a website visited by an unsuspecting user. This may allow a remote attacker to steal cookie-based authentication credentials, which could be used at a later time to hijack a users web session.
Exploit / POC
PHP-Nuke 6.0 Multiple Cross Site Scripting Vulnerabilities
The following proof of concept has been made available by phpsecure:
http://[target]/modules/Forums/bb_smilies.php?name=[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?Default_Theme=[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?site_font=}--></style>[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?bgcolor1=">[SCRIPT]
or with :
$sitename
$table_width
$color1
$forumver
/modules/Forums/bbcode_ref.php with :
$name
$Default_Theme
$site_font
$sitename
$bgcolor2
$textcolor1
$bgcolor1
$forumver
/modules/Forums/editpost.php, /modules/Forums/newtopic.php,
/modules/Forums/reply.php, /modules/Forums/topicadmin.php,
/modules/Forums/viewforum.php with :
$name
/modules/Forums/searchbb.php with :
$name
$bgcolor3
$bgcolor1
The following proof of concept has been made available by phpsecure:
http://[target]/modules/Forums/bb_smilies.php?name=[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?Default_Theme=[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?site_font=}--></style>[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?bgcolor1=">[SCRIPT]
or with :
$sitename
$table_width
$color1
$forumver
/modules/Forums/bbcode_ref.php with :
$name
$Default_Theme
$site_font
$sitename
$bgcolor2
$textcolor1
$bgcolor1
$forumver
/modules/Forums/editpost.php, /modules/Forums/newtopic.php,
/modules/Forums/reply.php, /modules/Forums/topicadmin.php,
/modules/Forums/viewforum.php with :
$name
/modules/Forums/searchbb.php with :
$name
$bgcolor3
$bgcolor1
Solution / Fix
PHP-Nuke 6.0 Multiple Cross Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PHP-Nuke 6.0 Multiple Cross Site Scripting Vulnerabilities
References:
References:
- PHPNuke INP Homepage (PHPNuke INP)
- PHP-Nuke 6.0 : Path Disclosure & Cross Site Scripting ("Frog Man"