NewsPHP Cross Site Scripting - Advisories

NewsPHP Cross Site Scripting

Secunia Advisory:	SA8952
Release Date:	2003-06-06

Critical:	Less critical
Impact:	Cross Site Scripting
Where:	From remote
Solution Status:	Unpatched

Software:	NewsPHP

	This advisory is currently marked as unpatched! - Companies can be alerted when a patch is released!

Description: A vulnerability has been identified in NewsPHP allowing malicious people to conduct Cross Site Scripting. The problem is that HTML and scripting is allowed in comments. This allows trivial and "persistant" Cross Site Scripting. Solution: Edit the source code to verify user input and remove potentially malicious characters. Provided and/or discovered by: Donnie Werner, exploitlabs.com Original Advisory: http://exploitlabs.com/files/advisories/expl-a-2003-003-newsphp.txt



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

3 Related Secunia Security Advisories

1. NewsPHP Cross-Site Scripting Vulnerabilities

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	OpenOffice "rtl_allocateMe mory()" Truncation Vulnerability

2.	HP-UX update for Apache

3.	R "javareconf" Insecure Temporary Files

4.	Honeyd "test.sh" Insecure Temporary Files

5.	Tiger "genmsgidx" Insecure Temporary Files

6.	Quick Poll "id" SQL Injection Vulnerability

7.	Ampache "gather-message s.sh" Insecure Temporary Files

8.	JustSystems Ichitaro Products Unspecified Code Execution Vulnerability

9.	Red Hat update for tomcat

10.	Red Hat update for adminutil