EUVD-2006-1377

Malware in sbrugna...

CVE-2006-1373: Undefined Security Weakness

Cross-site scripting XSS vulnerability in statusimage.php in PHP Live! 3.0 allows remote attackers to inject arbitrary web script or HTML via the baseurl parameter...

PHP Live! XSS status_image.php

Date: 03/22/2006 Vendor: OSI Codes Product: PHP Live! Versions: tested 3.0 Vulnerability: Cross Site Scripting Location: statusimage.php Exploit: /phplive/js/statusimage.php?baseurl=scriptalertdocument.cookie/script Stumbled across this while auditing a web server, vendor has been notified...