PHP-NuKe Remote Cross-Site Scripting Vulnerability

vendor:

PHP-NuKe

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting (XSS)

79 (Cross-Site Scripting)

CWE

Product Name: PHP-NuKe

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: Unknown

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Unknown

Unknown

PHP-NuKe Remote Cross-Site Scripting Vulnerability

PHP-NuKe is vulnerable to a remote cross-site scripting (XSS) vulnerability. The vulnerability is caused by the 'cookiedecode()' function failing to properly sanitize user-supplied cookie parameters. This allows a remote attacker to create a malicious link that includes hostile HTML and script code. If a victim user follows this link, the hostile code may be rendered in their web browser, potentially leading to the theft of cookie-based authentication credentials or other attacks.

Mitigation:

It is recommended to apply the latest patches or updates provided by the vendor to address this vulnerability. Additionally, input validation and output encoding should be implemented to properly sanitize user-supplied data.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10128/info

Reportedly PHP-NuKe is prone to a remote cross-site scripting vulnerability. This issue is due to a failure of the 'cookiedecode()' function to properly sanitize user supplied cookie parameters.

These issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://localhost/nuke71/index.php?user=MTo8c2NyaXB0PmFsZXJ0KGRvY3VtZW50LmNvb2tpZSk7PC9zY3JpcHQ%2bZm9vYmFy