Nuked-Klan Forum Module HTML Injection Vulnerability

Bugtraq ID:	6699
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 27 2003 12:00AM
Updated:	Jan 27 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to "Grégory" Le Bras <[email protected]>.
Vulnerable:	Nuked-Klan Nuked-Klan 1.2 beta
Not Vulnerable:	Nuked-Klan Nuked-Klan 1.3 beta

Nuked-Klan Forum Module HTML Injection Vulnerability

A vulnerability has been discovered in the Nuked-Klan 'Forum' module. It has been reported that Nuked-Klan fails to sufficiently sanitize script code embedded in certain user-supplied variables.

As a result, attackers may embed malicious script code or HTML into forum posts. When a malicious post is viewed by another user, the attacker-supplied code will be interpreted in their web browser in the security context of the site hosting the software.

Nuked-Klan Forum Module HTML Injection Vulnerability

There is no exploit required.

Nuked-Klan Forum Module HTML Injection Vulnerability

Solution:
It has been reported that Nuked-Klan 1.3 beta is not affected by this issue.

Nuked-Klan Forum Module HTML Injection Vulnerability

References:

• [SCSA-003] Multiple Cross Site Scripting & Script Injection Vulnerabilities in N (Grégory Le Bras )