Lucene search

K

fuzzylime302-xss.txt

🗓️ 22 Sep 2008 00:00:00Reported by Fabian FingerleType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 25 Views

Cross Site Scripting (XSS) Vulnerability in fuzzylime (cms) >=3.02, CVE-2008-3098. Fuzzylime (cms) allows injection of JavaScript leading to potential security risks

Show more
Related
Code
ReporterTitlePublishedViews
Family
Prion
Cross site scripting
24 Sep 200814:56
prion
Cvelist
CVE-2008-3098
24 Sep 200814:00
cvelist
NVD
CVE-2008-3098
24 Sep 200814:56
nvd
securityvulns
Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02, CVE-2008-3098
24 Sep 200800:00
securityvulns
securityvulns
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
24 Sep 200800:00
securityvulns
CVE
CVE-2008-3098
24 Sep 200814:56
cve
`Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02,  
CVE-2008-3098   
  
References  
  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3098  
http://cms.fuzzylime.co.uk  
  
  
Description  
  
Fuzzylime (cms) is a way to run websites and keep it up-to-date. Once  
installed, you can update from any internet-connected PC in the world -  
you don't even need to know HTML! It has tons of features so whatever  
you want from your site, chances are this script will be able to do it  
for you.   
  
Example  
  
Assuming Fuzzylime is installed on http://localhost/fuzzylime/, anybody  
could inject JavaScript:  
  
<form method="post" action="http://localhost/fuzzylime/admin/usercheck.php">  
<input type="hidden" name="log" value="in">  
<input type="text" name="user"value='"><script>alert(1)</script>'>  
<input type=submit></form>  
  
Disclosure Timeline  
  
2008-09-10 Vendor contacted  
2008-09-20 Vendor released 3.03  
2008-09-22 Advisory published  
  
CVE Information  
  
The Common Vulnerabilities and Exposures (CVE) project has assigned the  
name CVE-2008-3098 to this issue. This is a candidate for inclusion in  
the CVE list (http://cve.mitre.org/), which standardizes names for  
security problems.   
  
Credits and copyright  
  
This vulnerability was discovered by Fabian Fingerle (published with  
help from Hanno Boeck). It's licensed under the creative commons  
attribution license.  
  
Fabian Fingerle, 2008-09-22, http://www.fabian-fingerle.de  
  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
22 Sep 2008 00:00Current
6.7Medium risk
Vulners AI Score6.7
EPSS0.004
25
.json
Report