Related information

Crossite scripting in PHPNuke/PostNUKE

More Cross site Scripting in PHPNuke

Security bugs in PhpNuke

PHP-Nuke 5.5 , Phortail 1.2.1 , Avotravis 2.1

CSS in PHPNuke add-on

From:	frog frog <leseulfrog_(at)_hotmail.com>
Date:	17.12.2001
Subject:	PHPNuke Cross Scripting...

Here a few holes that i've found in PHPNuke.
5 "Cross Site Scripting".

http://phpnuke.org/modules.php?
name=Downloads&d_op=viewdownloaddetails&lid=0
2&ttitle=[JAVASCRIPT]

http://phpnuke.org/modules.php?
name=Downloads&d_op=ratedownload&lid=118&ttitle
=[JAVASCRIPT]

http://phpnuke.org/modules.php?
op=modload&name=Members_List&file=index&letter
=[JAVASCRIPT]

http://phpnuke.org/submit.php?subject=
[JAVASCRIPT]&story=[JAVASCRIPT]&storyext=
[JAVASCRIPT]&op=Preview

http://phpnuke.org/user.php?op=userinfo&uname=
[JAVASCRIPT]


and /admin.php?upload=Go! who's the same that
upload=1 .

frog-m@n