PHP-Nuke Cross-Site Scripting Vulnerabilities, Alert

[iGuest 3]

Janek Vind "waraxe" has reported two vulnerabilities in PHP-Nuke, which can be exploited by malicious people to conduct cross-site scripting attacks.

 

Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

 

Example:

http://forums.xisto.com/no_longer_exists/]'>http://forums.xisto.com/no_longer_exists/]

http://forums.xisto.com/no_longer_exists/]'>http://forums.xisto.com/no_longer_exists/]

 

It has also been reported that the full path to some scripts can be disclosed.

 

Example:

http://forums.xisto.com/no_longer_exists/

http://forums.xisto.com/no_longer_exists/

http://forums.xisto.com/no_longer_exists/

http://forums.xisto.com/no_longer_exists/

 

The vulnerabilities have been reported in version 6.x through 7.6. Other versions may also be affected.

 

Solution:

Edit the source code to ensure that input is properly sanitised. Production systems should not return error messages to clients.

 

Provided and/or discovered by:

Janek Vind "waraxe"