PostNuke Modules.PHP Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	7898
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 13 2003 12:00AM
Updated:	Jun 13 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to David F. Madrid <[email protected]>.
Vulnerable:	PostNuke Development Team PostNuke Phoenix 0.723
Not Vulnerable:

PostNuke Modules.PHP Multiple Cross-Site Scripting Vulnerabilities

The PostNuke 'modules.php' script does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a web page that contains the malicious code.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

PostNuke Modules.PHP Multiple Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PostNuke Modules.PHP Multiple Cross-Site Scripting Vulnerabilities

References:

• PostNuke Homepage (PostNuke Development Team)
  
• Cross site scripting in Post-Nuke ("David F. Madrid" )