Secunia

An information disclosure vulnerability has been identified in PHP-Nuke, which can be exploited by malicious people to gain knowledge of the administrator username and password.

The vulnerability is caused by an input validation error. Input supplied to the "$referer" variable is not filtered when inserted into the backend database, which makes it possible to include arbitrary script code. When viewed by an administrator, the script code will be executed automatically in the administrator's browser session and could eg. steal the authentication cookie associated with the website, which contains the administrator's username and password.

Solution
Edit the source code to filter input supplied to the "$referer" variable.

Provided and/or discovered by
zx

Deep Links
Links available in Customer Area