Re: Sql injection, xss and path disclosure vulnerabilities in PostNuke 0.760-RC3

To: dcrab@xxxxxxxxxxxxxxxxx
Subject: Re: Sql injection, xss and path disclosure vulnerabilities in PostNuke 0.760-RC3
From: "Dionysios G. Synodinos" <synodinos@xxxxxxxxx>
Date: Sat, 9 Apr 2005 01:14:14 +0300
Cc: bugtraq@xxxxxxxxxxxxxxxxx
Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=t5Yvdtsrv71zzFGDiXWYRDqSQjBn8p1DjcatX9uWpSx1CAyExNHJHKwBuRs94fxnj51ZIJEYYUzBzFIAQg6Dz0E1j4I7yuqwtp/AVTunVl2FoPTx6hRNsOzNM3Tx+mBEFTK2WfSwZzPcmXVelAudB5H5Cc4gnWrbkQcKjueEh40=
In-reply-to: <42570117.3e3c9de0.5221.2653SMTPIN_ADDED@xxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <42570117.3e3c9de0.5221.2653SMTPIN_ADDED@xxxxxxxxxxxx>
Reply-to: "Dionysios G. Synodinos" <synodinos@xxxxxxxxx>

A discusion regarding this issue can be found at the official PN
forum: http://forums.postnuke.com/index.php?name=PNphpBB2&file=viewtopic&t=39513