SECUNIA ADVISORY ID: SA22175

VERIFY ADVISORY: http://secunia.com/advisories/22175/

CRITICAL: Less critical

IMPACT: Cross Site Scripting

WHERE: >From remote

SOFTWARE: CubeCart 2.x - http://secunia.com/product/4021/

DESCRIPTION: HACKERS PAL has discovered some vulnerabilities in CubeCart, which can be exploited by malicious people to conduct cross-site scripting attacks. Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Examples:
http://[host]/admin/nav.php?site_url=[code]
http://[host]/admin/nav.php?la_search_home=[code]
http://[host]/admin/header.inc.php?site_name=[code]
http://[host]/admin/header.inc.php?la_adm_header=[code]
http://[host]/admin/header.inc.php?charset=[code]
http://[host]/footer.inc.php?la_pow_by=[code]
Successful exploitation requires that "register_globals" is enabled. The vulnerabilities have been confirmed in version 2.0.7. Other versions may also be affected.
SOLUTION: The 3.x branch is not affected by the vulnerabilities. Edit the source code to ensure that input is properly sanitised. Set "register_globals" to "Off".
PROVIDED AND/OR DISCOVERED BY: HACKERS PAL

Truden writes:  

Today's contribution will be the hack of modules/News/comments.php
I use this file for two years now, and I've never had robot spam in my comments.
There are some more functions added to the file for better administration and user navigation.

Take it from HERE, and enjoy No-SPAM comments :-)

Love to All! Truden.

lippylion writes:  

Kissoftware has now been relocated and has a new url - Please enusre you update your bookmarks
We are updating the site and adding more features together wuth the release of Nukequiz 2.5.0 for subscribers. More projects are ongoing including Nuke support (Helpdesk for Nuke) and modifications to the Newsletter module, plus more downloads have been added to our downloads section.
You can find us @ kissoftware[dot]org[dot]uk

southern writes:  

Some good online tools for the... ah... discerning webmaster/webmistress.
We picked out the best scripts you should choose to build your site.(tm)

Our Online Tools
» Link Exchange
» Check your Section 508 Standards
» Regular Expression tester
» Link-popularity checker
» Search Engine Submission
» Chmod calculator
» IMAP reader
» Search

External Online Tools
Display and format our RSS feeds on your site: Cut and Paste JavaScript, FeedDigest.com
Validate: validators, Xforms validator, CSS Translator, semantic-extractor
Image: MyImager.com (resize), kalsey Buttonmaker, type converter, Logo Generator
PHP: PhpObjectGenerator.com
Markup: Accessify.com
Misc: UITest.com, FaganFinder.com, FOAF-a-matic, freesql.org, Email encoder

I don't have the time or inclination to provide links to all the listed tools but they're here: Programmabilities

papamike writes:  

Just released for download PMC4 which comes as part of the PMC series of themes. It follows PMC-NET (not available for download) and PMC2. PMC4 comes with crisp graphics, fast loading, and matching forums.

Membership is required for all downloads. Visit Papa Mike Creations to view and download this theme as well as other software apps., graphics, backgrounds, wallpaper and alot more.

Truden writes:  

The last few days I feel like contributing to the phpNuke community :)

Now you have the module and the block, which I use in Truden Web Site for News comments.
 Read More...