← back
CVE-2007-3060

CVE-2007-3060

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 5.0%
from disclosure to weapon0 days
Published on NVDJun 6
1st PoCJun 1
exploitation probability
5.0%top 9% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to (a) chat.php, (2) LANG[DEFAULT_BRANDING] and (3) PHPLIVE_VERSION parameters to (b) help.php, the (4) admin[name] parameter to (c) admin/header.php, and the (5) BASE_URL parameter to (d) super/info.php, and in some cases, the LANG[DEFAULT_BRANDING], PHPLIVE_VERSION, and (6) nav_line parameters to setup/footer.php, different vectors than CVE-2006-6769.
Affected products
n/a · n/a
public PoCs found — 5✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30135exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30137exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30136exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30133exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30134
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://marc.info/?l=full-disclosure&m=118072121020357&w=2http://osvdb.org/36986http://osvdb.org/36987http://osvdb.org/36988http://osvdb.org/36989http://osvdb.org/36990http://osvdb.org/38379http://osvdb.org/38380http://osvdb.org/38381http://osvdb.org/38382http://osvdb.org/38383http://secunia.com/advisories/25441