Description
Cross-site scripting vulnerabilities in ASP-Nuke RC2 and earlier allow remote attackers to execute script or gain privileges as other ASP-Nuke users via script in (1) the name parameter in downloads.asp, (2) the message parameter in Post.asp, or (3) a web site URL in profile.asp.
References
- aspnuke-user-profile-css(8831) vdb-entry
- 4477 vdb-entry
- 4481 vdb-entry
- 20020409 Security holes in ASP-Nuke mailing-list
- http://www.asp-nuke.com/news.asp?date=20020412&cat=11
- aspnuke-downloads-post-css(8830) vdb-entry
- http://www.ifrance.com/kitetoua/tuto/ASPNuke.txt