CVE-2007-3653
FaName 1.0 - Cross-Site Scripting via key/desc/name Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2007-3653. PoCs published by Jesper Jurcenoks.
AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in FaName 1.0, where user-supplied input is not properly sanitized. The example demonstrates how an attacker could inject arbitrary script code into the 'name' parameter of the 'page.php' script.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Farsi Script (aka FaScript) FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) key or (2) desc parameter to index.php, or (3) the name parameter to page.php.
Exploits (2)
The provided text describes a cross-site scripting (XSS) vulnerability in FaName 1.0, where user-supplied input is not properly sanitized. The example demonstrates how an attacker could inject arbitrary script code into the 'name' parameter of the 'page.php' script.
This exploit demonstrates a cross-site scripting (XSS) vulnerability in FaName 1.0 by injecting malicious script tags into the 'key' and 'desc' parameters of the index.php file. The PoC shows how an attacker can execute arbitrary JavaScript in the context of the affected site.