This host is installed with Zikula and is prone to cross-site scripting vulnerability.

Successful exploitation will allow attacker to execute arbitrary HTML script code in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to Zikula Application Framework version to 1.3.6 build 19 or later, For updates refer to http://zikula.org

An error exists in the index.php script which fails to properly sanitize user-supplied input to 'returnpage' parameter.

Zikula Application Framework version prior to 1.3.6 build 19

Send a crafted exploit string via HTTP GET request and check whether it is able to read the string or not.

• http://packetstormsecurity.com/files/124009
• http://xforce.iss.net/xforce/xfdb/88654

---

Updated on 2015-03-25