myPHPNuke 1.8.8 – ‘Default_Theme’ Cross-Site Scripting

myPHPNuke 1.8.8 – ‘Default_Theme’ Cross-Site Scripting

漏洞ID 1053672 漏洞类型
发布时间 2003-01-06 更新时间 2003-01-06
图片[1]-myPHPNuke 1.8.8 – ‘Default_Theme’ Cross-Site Scripting-安全小百科CVE编号 N/A
图片[2]-myPHPNuke 1.8.8 – ‘Default_Theme’ Cross-Site Scripting-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22133
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/6544/info

Reportedly, myPHPNuke does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the website running myPHPNuke.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. 

http://victim/html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>
http://victim/html/chatheader.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>

相关推荐: Evolvable Shambala Server 4.5 DoS Vulnerability

Evolvable Shambala Server 4.5 DoS Vulnerability 漏洞ID 1103776 漏洞类型 Failure to Handle Exceptional Conditions 发布时间 2000-10-09 更新时间 20…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享