TUCoPS :: Web :: CMS / Portals :: va1337.htm

fuzzylime (cms) >=3.02 XSS, CVE-2008-3098
Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02, CVE-2008-3098
Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02, CVE-2008-3098



This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.

--=_zucker.schokokeks.org-32747-1222108099-0001-2
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02,
CVE-2008-3098 

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3098 
http://cms.fuzzylime.co.uk 
http://www.datensalat.eu/~fabian/cve/CVE-2008-3098-fuzzylime-cms.html 


Description

Fuzzylime (cms) is a way to run websites and keep it up-to-date. Once
installed, you can update from any internet-connected PC in the world -
you don't even need to know HTML! It has tons of features so whatever
you want from your site, chances are this script will be able to do it
for you. 

Example

Assuming Fuzzylime is installed on http://localhost/fuzzylime/, anybody 
could inject JavaScript:

action="http://localhost/fuzzylime/admin/usercheck.php">
Disclosure Timeline 2008-09-10 Vendor contacted 2008-09-20 Vendor released 3.03 2008-09-22 Advisory published CVE Information The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-3098 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. Credits and copyright This vulnerability was discovered by Fabian Fingerle (published with help from Hanno Boeck). It's licensed under the creative commons attribution license. Fabian Fingerle, 2008-09-22, http://www.fabian-fingerle.de --=_zucker.schokokeks.org-32747-1222108099-0001-2 Content-Type: application/pgp-signature; name="signature.asc" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkjX48AACgkQ/aNqCatBq4Vx/QCePDppBj+RFb3LKxxF6zmg7f+5 93sAniZTfGCtQ1OXwOgaxlcsSuNMIyWG =W6Fn -----END PGP SIGNATURE----- --=_zucker.schokokeks.org-32747-1222108099-0001-2--

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH