Posts Tagged ‘phpFox’

Cross-site scriptingVulnerability Cross-site scripting phpFox

Affected products: phpFox 3.x

Affected versions: phpFox 3.3.0, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “message” in the script static / ajax.php (when the parameter “core [call]” equals “core.message”). This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site. (more…)