PostNuke Critical XSS x=>0.760-RC2

Published / (Updated)
Credit
Risk
2005-10-01 / 2005-09-30
Maksymilian Arciemowicz
Low
CWE
CVE
Local
Remote
CWE-79
CVE-2005-0616
No
Yes

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

PostNuke Critical XSS 0.760-RC2=>x cXIb8O3.2]

Author: Maksymilian Arciemowic
Date: 19.2.2005

- --- 0.Description ---

PostNuke: The Phoenix Release (0.750) and (0.760-RC2)

PostNuke is an open source, open developement content management system
(CMS). PostNuke started as a fork from PHPNuke (http://www.phpnuke.org) and
provides many enhancements and improvements over the PHP-Nuke system. PostNuke
is still undergoing development but a large number of core functions are now
stabilising and a complete API for third-party developers is now in place.
If you would like to help develop this software, please visit our homepage
at http://noc.postnuke.com/
You can also visit us on our IRC Server irc.postnuke.com channel
#postnuke-support
#postnuke-chat
#postnuke
Or at the Community Forums located at:
http://forums.postnuke.com/


- --- 1. Critical XSS in Download module ---
When we go to this url :


http://[HOST]/[DIR]/modules.php?op=modload&name=Downloads&file=index&req=AddDownload

or

We can add XSS by passing unexpected data to the 'Program name' or 'File link' or 'Author s
name' or 'Author s e-mail address' or 'File size' or 'Version' or 'Home page' variable.

For exemple:

"><script>alert('cXIb8O3');</script>


Why this XSS is critical ?
Because when admin login in and try to view new downloads, then our XSS will run on his
machine.
Evil attacker can create dangerous XSS to steal data (admin cookie with session) or change the
site.

- --- 2. How to fix ---

Download the new version of the script or update.


- --- 3.Contact ---
Author: Maksymilian Arciemowicz


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2016, cxsecurity.com