|
Description
|
|
Multiple vulnerabilities were identified in PostNuke, which could be exploited by malicious people to bypass security restrictions, and perform SQL injection or cross site scripting attacks.
The first issue is due to input validation errors in the "pnVarCleanFromInput()" and "pnAntiCracker()" functions that do not properly validate certain HTML tags, which could be exploited by attackers to cause malicious scripting code to be executed by the user's browser.
The second flaw is due to input validation errors in the NS-Languages module and the "user.php" script that do not properly validate the "htmltext" parameter, which could be exploited by attackers to cause malicious scripting code to be executed by the user's browser.
The third vulnerability is due to an input validation error in the NS-Languages module that does not properly validate the "language" parameter, which could be exploited by malicious people to conduct SQL injection attacks.
The fourth issue is due to an access validation error in the "admin.php" script, which could be exploited by attackers to gain unauthorized access to the NS-Languages and Banners modules.
|
