Multiple vulnerabilities in PostNuke Phoenix

vendor:

PostNuke Phoenix

by:

Unknown

N/A

CVSS

N/A

Path disclosure, Cross-site scripting

Unknown

CWE

Product Name: PostNuke Phoenix

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE: Unknown

CPE: Unknown

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

Multiple vulnerabilities in PostNuke Phoenix

Multiple path disclosure vulnerabilities that occur when a user directly requests scripts in the '/includes/blocks/' and 'pnadodb' directories. This issue also affects scripts that are associated in multiple modules.Multiple cross-site scripting vulnerabilities were reported in the Downloads and Web_Links modules as well as the openwindow.php script. These issues may permit remote attackers to cause hostile HTML and script code to be interpreted by a victim user's browser.

Mitigation:

Unknown

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10191/info

Multiple vulnerabilities were reported to exist in PostNuke Phoenix. The following specific vulnerabilities were reported: 

- Multiple path disclosure vulnerabilities that occur when a user directly requests scripts in the "/includes/blocks/" and "pnadodb" directories. This issue also affects scripts that are associated in multiple modules.

- Multiple cross-site scripting vulnerabilities were reported in the Downloads and Web_Links modules as well as the openwindow.php script. These issues may permit remote attackers to cause hostile HTML and script code to be interpreted by a victim user's browser.

http://www.example.com/postnuke0726/javascript/openwindow.php?hlpfile=x<html><body>[xss code here]
http://www.example.com/postnuke0726/javascript/openwindow.php?hlpfile=x<html><body%20onload=alert(document.cookie);>