CVE-2004-1957
PostNuke 0.726 - Cross-Site Scripting via Downloads, Web_links, or openwindow.php Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2004-1957. PoCs published by Janek Vind, Lorenzo Hernandez Garcia-Hierro.
AI-analyzed exploit summary The provided text describes multiple vulnerabilities in PostNuke Phoenix, including path disclosure and cross-site scripting (XSS) issues. It includes example URLs demonstrating XSS exploitation via the 'hlpfile' parameter in openwindow.php.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PostNuke 0.726 allows remote attackers to inject arbitrary web script or HTML via the (1) lid and query parameters to the Downloads module, (2) query parameter to the Web_links module, or (3) hlpfile parameter to openwindow.php.
Exploits (2)
The provided text describes multiple vulnerabilities in PostNuke Phoenix, including path disclosure and cross-site scripting (XSS) issues. It includes example URLs demonstrating XSS exploitation via the 'hlpfile' parameter in openwindow.php.
This is a writeup describing a cross-site scripting (XSS) vulnerability in PostNuke's Downloads and Web_Links modules. The vulnerability allows an attacker to inject malicious script code via a crafted URL, potentially leading to cookie theft.