37141vdb entry
http://osvdb.org/37141 CVE-2007-3339
FuseTalk 4.0 - 'forum/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site Scripting
Record summary
CVE-2007-3339 has a selected CVSS score of 4.3; EIP currently links 3 catalogued exploits.
Description
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a) forum/include/error/autherror.cfm, and the (3) FTVAR_SCRIPTRUN parameter to (b) forum/include/common/comfinish.cfm and (c) blog/include/common/comfinish.cfm.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 3
Proofs of concept
3Catalogued exploits
ExploitDBFuseTalk 4.0 - 'forum/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site ScriptingExploitDB exploitby Ivan AlmuinaNot analyzed1 file
ExploitDBFuseTalk 4.0 - 'blog/include/common/comfinish.cfm?FTVAR_SCRIPTRUN' Cross-Site ScriptingExploitDB exploitby Ivan AlmuinaNot analyzed1 file
ExploitDBFuseTalk 4.0 - 'AuthError.cfm' Multiple Cross-Site Scripting VulnerabilitiesExploitDB exploitby Ivan AlmuinaNot analyzed1 file
References
1137142vdb entry
http://osvdb.org/37142 37143vdb entry
http://osvdb.org/37143 25707Third-party advisory
http://secunia.com/advisories/25707 2842Third-party advisory
http://securityreason.com/securityalert/2842 20070620 fusetalk CSS (comfinish.cfm)mailing list
http://www.securityfocus.com/archive/1/471846/100/0/threaded 20070620 fusetalk CSS (autherror.cfm)mailing list
http://www.securityfocus.com/archive/1/471853/100/0/threaded 24563vdb entry
http://www.securityfocus.com/bid/24563 24564vdb entry
http://www.securityfocus.com/bid/24564 fusetalk-comfinish-autherror-xss(34955)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34955 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2007-3339