TUCoPS :: HP Unsorted B :: tb13367.htm

broadcast machine XSS
CVE-2007-3694: Cross site scripting (XSS) in broadcast machine
CVE-2007-3694: Cross site scripting (XSS) in broadcast machine



--nextPart3581826.sm6rzc6rZB
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Source:
http://int21.de/cve/CVE-2007-3694-bm.html 

Cross site scripting (XSS) in broadcast machine

References
http://www.getmiro.com/create/broadcast/ 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3694 

Description
 Cross site scripting describes attacks that allow to insert malicious html or 
 javascript code via get or post forms. This can be used to steal session
 cookies.
 Broadcast machine is a web-based video platform tool. It's login form is
 vulnerable to XSS.

Sample code
action="http://somesite.com/login.php" method="post">
Workaround/Fix Vendor consideres broadcast machine dead software and won't provide any updates. However it's still used on some live sites in the internet. CVE Information The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2007-3694 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. Credits and copyright This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosting. It's licensed under the creative commons attribution license. Hanno Boeck, 2007-11-12, http://www.hboeck.de --nextPart3581826.sm6rzc6rZB Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.7 (GNU/Linux) iD8DBQBHOE0rr2QksT29OyARAkS2AJ90gXA6QDni/o4yRTor6JETPJmgfQCggch+ jDHiO2S9hCmCm8r8MulWwh4=SIIi -----END PGP SIGNATURE----- --nextPart3581826.sm6rzc6rZB--

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH