FuseTalk ComFinish.CFM Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	24563
Class:	Input Validation Error
CVE:	CVE-2007-3339
Remote:	Yes
Local:	No
Published:	Jun 20 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Ivan Almuina is credited with the discovery of these vulnerabilities.
Vulnerable:	FuseTalk Inc. FuseTalk 4.0 FuseTalk Inc. FuseTalk 3.0 FuseTalk Inc. FuseTalk 2.0
Not Vulnerable:

FuseTalk ComFinish.CFM Multiple Cross Site Scripting Vulnerabilities

FuseTalk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

FuseTalk ComFinish.CFM Multiple Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

The following examples are available:

http://www.example.com/forum/include/common/comfinish.cfm?FTRESULT.errorcode=0&FTVAR_SCRIPTRUN=[xss]

http://www.example.com/blog/include/common/comfinish.cfm?FTRESULT.errorcode=0&FTVAR_SCRIPTRUN=[xss]

FuseTalk ComFinish.CFM Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has reportedly released patches to address these issues, but this has not been confirmed. Please contact the vendor for more information.

FuseTalk ComFinish.CFM Multiple Cross Site Scripting Vulnerabilities

References:

• FuseTalk Homepage (FuseTalk Inc.)
  
• fusetalk CSS (comfinish.cfm) ([email protected])