fuzzylime (cms) >=3.02 XSS

2008.09.26
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Cross Site Scripting (XSS) Vulnerabilitiy in fuzzylime (cms) >=3.02, CVE-2008-3098 References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3098 http://cms.fuzzylime.co.uk http://www.datensalat.eu/~fabian/cve/CVE-2008-3098-fuzzylime-cms.html Description Fuzzylime (cms) is a way to run websites and keep it up-to-date. Once installed, you can update from any internet-connected PC in the world - you don't even need to know HTML! It has tons of features so whatever you want from your site, chances are this script will be able to do it for you. Example Assuming Fuzzylime is installed on http://localhost/fuzzylime/, anybody could inject JavaScript: <form method="post" action="http://localhost/fuzzylime/admin/usercheck.php"> <input type="hidden" name="log" value="in"> <input type="text" name="user"value='"><script>alert(1)</script>'> <input type=submit></form> Disclosure Timeline 2008-09-10 Vendor contacted 2008-09-20 Vendor released 3.03 2008-09-22 Advisory published CVE Information The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-3098 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. Credits and copyright This vulnerability was discovered by Fabian Fingerle (published with help from Hanno Boeck). It's licensed under the creative commons attribution license. Fabian Fingerle, 2008-09-22, http://www.fabian-fingerle.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkjX48AACgkQ/aNqCatBq4Vx/QCePDppBj+RFb3LKxxF6zmg7f+5 93sAniZTfGCtQ1OXwOgaxlcsSuNMIyWG =W6Fn -----END PGP SIGNATURE-----

References:

http://www.frsirt.com/english/advisories/2008/2650
http://secunia.com/advisories/31980
http://cms.fuzzylime.co.uk/st/content/download/
http://www.securityfocus.com/bid/31306
http://www.securityfocus.com/archive/1/archive/1/496589/100/0/threaded
http://www.datensalat.eu/~fabian/cve/CVE-2008-3098-fuzzylime-cms.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top