https://www.exploit-db.com/exploits/21933
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-747

phpRank1.8版本存在跨站脚本(XSS)漏洞。远程攻击者可以通过(1)add.php中的email参数或(2)banurl参数注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/5945/info

phpRank is a freely available web site link sharing script. It is available for Unix, Linux, and Microsoft operating systems.

It has been reported that phpRank is vulnerable to cross-site scripting attacks. Under some circumstances, it is possible to force the rendering of arbitrary HTML and script code through the add.php portion of the phpRank package. This could allow the execution of potentially malicious script and HTML in the security context of a vulnerable site. 

http://example.com/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(42)%3C/script%3E

来源:BUGTRAQ
名称:20021010MultiplevulnerabilitiesinphpRank
链接:http://archives.neohapsis.com/archives/bugtraq/2002-10/0148.html
来源:BID
名称:5945
链接:http://www.securityfocus.com/bid/5945
来源:XF
名称:phprank-javascript-xss(10336)
链接:http://www.iss.net/security_center/static/10336.php