https://www.exploit-db.com/exploits/21859
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-226

PHP-Nuke6.0版本存在跨站脚本(XSS)漏洞。远程攻击者可以通过IMG中的Javascript注入任意web脚本或HTML。

source: http://www.securityfocus.com/bid/5796/info

Problems with PHPNuke could make it possible to execute arbitrary script code in a vulnerable client.

PHPNuke does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the PHPNuke software. 

<IMG SRC="javascript:alert('unsecure')">

来源:BID
名称:5796
链接:http://www.securityfocus.com/bid/5796
来源:XF
名称:cms-news-image-xss(10173)
链接:http://www.iss.net/security_center/static/10173.php
来源:BUGTRAQ
名称:20020924ECHUAlert#2:IMGAttackinthenews:6CMSvulnerables
链接:http://archives.neohapsis.com/archives/bugtraq/2002-09/0307.html