Secunia

PHP-Nuke has been found vulnerable to a Cross Site Scripting issue and execution of arbitrary code.

It is possible to place arbitrary code php code on systems running PHP-Nuke, by sending an email to a user of the web based email interface. When a user reads an email with a php file attached it is saved in a predictable location. An attacker may then execute the code by pointing his browser to the URL.

Also the web mail system does not strip <script> and other html tags, this allows an attacker to perform Cross Site Scripting.

Solution
There is no update available. Third parties has made various security enhancements to PHP-Nuke which eliminates these problems.
Further details available in Customer Area

Provided and/or discovered by
Ulf Harnhammar

Deep Links
Links available in Customer Area