https://www.exploit-db.com/exploits/25800
https://www.securityfocus.com/bid/89170
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200506-081

FlatNuke2.5.3中存在跨站脚本攻击(XSS)漏洞，远程攻击者可借助提交到：(1)help.php脚本，或(2)footer.php脚本中的border参数或back参数，来注入任意Web脚本或HTML。

source: http://www.securityfocus.com/bid/13882/info
 
Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.
 
An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

http://www.example.com/forum/help.php?border=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/forum/help.php?back=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

FlatNuke FlatNuke 2.5.3

来源:VUPEN
名称:ADV-2005-0697
链接:http://www.frsirt.com/english/advisories/2005/0697
来源:SECTRACK
名称:1014114
链接:http://securitytracker.com/id?1014114
来源:SECUNIA
名称:15603
链接:http://secunia.com/advisories/15603
来源:MISC
链接:http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt
来源:flatnuke.sourceforge.net
链接:http://flatnuke.sourceforge.net/index.php?mod=read&id;=1117979256