myPHPNuke Links.php Cross Site Scripting Vulnerability

Bugtraq ID:	6892
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 20 2003 12:00AM
Updated:	Feb 20 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Tacettin: Karadeniz <[email protected]>.
Vulnerable:	myPHPNuke myPHPNuke 1.8.8 _final_7 myPHPNuke myPHPNuke 1.8.8
Not Vulnerable:

myPHPNuke Links.php Cross Site Scripting Vulnerability

Reportedly, myPHPNuke 'links.php' does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running myPHPNuke.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

This vulnerability was reported for myPHPNuke 1.8.8 earlier versions may also be affected.

myPHPNuke Links.php Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

myPHPNuke Links.php Cross Site Scripting Vulnerability

References:

• myPHPNuke Homepage (myPHPNuke)
  
• myphpnuke links.php vulnerability (Tacettin Karadeniz )