Multiple cross-site scripting (XSS) vulnerabilities in the RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allow remote attackers to inject arbitrary web script or HTML via the (1) rss_url parameter to magpie_slashbox.php, or the url parameter to (2) magpie_simple.php or (3) magpie_debug.php.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Postnuke | Postnuke_software_foundation | 0.750 (including) | 0.750 (including) |
| Postnuke | Postnuke_software_foundation | 0.760_rc2 (including) | 0.760_rc2 (including) |
| Postnuke | Postnuke_software_foundation | 0.760_rc3 (including) | 0.760_rc3 (including) |
References
- http://marc.info/?l=bugtraq\u0026m=111670482500552\u0026w=2
- http://marc.info/?l=bugtraq\u0026m=111670506926649\u0026w=2
- http://news.postnuke.com/modules.php?op=modload\u0026name=News\u0026file=article\u0026sid=2691
- http://marc.info/?l=bugtraq\u0026m=111670482500552\u0026w=2
- http://marc.info/?l=bugtraq\u0026m=111670506926649\u0026w=2
- http://news.postnuke.com/modules.php?op=modload\u0026name=News\u0026file=article\u0026sid=2691