PHP-Nuke "off-site Avatar" Script Insertion Vulner

[niall]

Input passed to the "Link to off-site Avatar" field isn't properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session.
Successful exploitation requires that the "Enable remote avatars" setting is enabled (disabled by default).

[Anonymous]

Have to say I'm inpressed at this forum. A lot of hosting companies don't bother to inform clients of issues with Third Party PHP scripts etc.

Take Hosting 365.ie - they take your money and run!!

[niall]

Thanks!
We can't cover all 3rd party scripts, but we'll post notices about any scripts that can be installed automatically (see http://www.blacknight.ie/installatron.0.html)