[ Home | Liste | F.A.Q. | Risorse | Cerca... ]


[ Data: precedente | successivo | indice ] [ Argomento: precedente | successivo | indice ] 

Archivio: Dicembre 2001 ml@sikurezza.org
Soggetto: PhpNuke Again...
Mittente: Amodiovalerio Verde
Data: 28 Dec 2001 15:50:36 -0000

Date:  Dec 24 2001

Impact:  Disclosure of authentication information, Disclosure of user
information, Execution of arbitrary code via network

Description:  A cross-site scripting vulnerability was reported in the
PHP-Nuke 'friend.php' module. A remote user can write HTML code containing
malicious javascript that, if executed on another user's browser, will
execute in the security zone of a web site running PHP-Nuke.


Per maggiori info

http://www.securitytracker.com/alerts/2001/Dec/1003048.html


Valerio [Hypo] Verde


________________________________________________________
http://www.sikurezza.org - Italian Security Mailing List


[ Home | Liste | F.A.Q. | Risorse | Cerca... ]

www.sikurezza.org - Italian Security Mailing List
(c) 1999-2005