PHP-Wiki 1.2/1.3 - Cross-Site Scripting

Author: Pistone
type: webapps
platform: php
port: 
date_added: 2002-07-17 
date_updated: 2012-09-30 
verified: 1 
codes: CVE-2002-1070;OSVDB-5498 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5254/info

PHP-Wiki does not sufficiently sanitize HTML from URI parameters, making it prone to cross-site scripting attacks. An attacker may exploit this condition by enticing users to visit a malicious link which contains attacker-supplied script code.

PHP-Wiki may be used as a module for other software such as PostNuke.

http://target/path/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert(document.cookie)</script>