CVE-2007-3694-bm.txt

`Source:  
http://int21.de/cve/CVE-2007-3694-bm.html  
  
Cross site scripting (XSS) in broadcast machine  
  
References  
http://www.getmiro.com/create/broadcast/  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3694  
  
Description  
Cross site scripting describes attacks that allow to insert malicious html or   
javascript code via get or post forms. This can be used to steal session  
cookies.  
Broadcast machine is a web-based video platform tool. It's login form is  
vulnerable to XSS.  
  
Sample code  
<form action="http://somesite.com/login.php" method="post">  
<input type="text" name="username" value='"<script>alert(1)</script>'>  
<input type="submit"></form>  
  
Workaround/Fix  
Vendor consideres broadcast machine dead software and won't provide any  
updates. However it's still used on some live sites in the internet.  
  
CVE Information  
The Common Vulnerabilities and Exposures (CVE) project has assigned the name  
CVE-2007-3694 to this issue. This is a candidate for inclusion in the CVE  
list (http://cve.mitre.org/), which standardizes names for security problems.  
  
Credits and copyright  
This vulnerability was discovered by Hanno Boeck of schokokeks.org  
webhosting. It's licensed under the creative commons attribution license.  
  
Hanno Boeck, 2007-11-12, http://www.hboeck.de  
`