Cross-site scripting phpFox

Posted: September 6, 2012 in Vulnerabilities
Tags: , , ,

Cross-site scriptingVulnerability Cross-site scripting phpFox

Affected products: phpFox 3.x

Affected versions: phpFox 3.3.0, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “message” in the script static / ajax.php (when the parameter “core [call]” equals “core.message”). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://www.phpfox.com/

Solution: The way to eliminate the vulnerability does not exist at present.

links:

http://packetstormsecurity.org/files/116212/PhpFox-3.0.1-Cross-Site-Scripting.html

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s