7 lines
No EOL
486 B
Text
7 lines
No EOL
486 B
Text
source: http://www.securityfocus.com/bid/5254/info
|
|
|
|
PHP-Wiki does not sufficiently sanitize HTML from URI parameters, making it prone to cross-site scripting attacks. An attacker may exploit this condition by enticing users to visit a malicious link which contains attacker-supplied script code.
|
|
|
|
PHP-Wiki may be used as a module for other software such as PostNuke.
|
|
|
|
http://target/path/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert(document.cookie)</script> |