PHP-Nuke Splatt Forum 4.0 Module - Cross-Site Scripting

EDB-ID:

22557

CVE:

N/A




Platform:

PHP

Date:

2003-05-01


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux and pass the exam to become an Offensive Security Certified Professional (OSCP). All new content for 2020.

GET CERTIFIED

source: https://www.securityfocus.com/bid/7483/info

Splatt Forum is a public message board plugin designed to be used with PHPNuke.

It has been reported that Splatt Forum does not sufficiently filter user supplied URI parameters for the Splatt Forum 'Search' function.

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.

This vulnerability was reported to affect Splatt Forum version 4.0, it is not currently known if other versions are affected. 

Perform a search with the keywords:

<iframe src="http://www.example.com">