Exploit PHP-Nuke Splatt Forum 4.0 Module - Cross-Site Scripting

[Exploiter]

EDB-ID

22557

Проверка EDB

1. Пройдено

Автор

MORNING WOOD

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2003-05-01

source: https://www.securityfocus.com/bid/7483/info

Splatt Forum is a public message board plugin designed to be used with PHPNuke.

It has been reported that Splatt Forum does not sufficiently filter user supplied URI parameters for the Splatt Forum 'Search' function.

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.

This vulnerability was reported to affect Splatt Forum version 4.0, it is not currently known if other versions are affected. 

Perform a search with the keywords:

<iframe src="http://www.example.com">