Secunia

A vulnerability has been identified in PHP Nuke, which can be exploited by a malicious person to mount a XSS attack (Cross-Site Scripting) against another user.

The problem is that PHP Nuke doesn't perform input validation when inserting an image name of an Avatar into the database. This can be exploited by a malicious user to inject arbitrary HTML or scriptcode instead of an Avatar image by changing the Avatar select box into a text box. This can be used to steal another user's cookies if the user visits a page where the malicious user's Avatar image would have been displayed.

The length of the injected code is restricted to 30 characters due to the field's length in the database.

Solution
Upgrade PHP Nuke to version 6.5.

Provided and/or discovered by
delusion

Deep Links
Links available in Customer Area