CVE-2007-3060

Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to (a) chat.php, (2) LANG[DEFAULT_BRANDING] and (3) PHPLIVE_VERSION parameters to (b) help.php, the (4) admin[name] parameter to (c) admin/header.php, and the (5) BASE_URL parameter to (d) super/info.php, and in some cases, the LANG[DEFAULT_BRANDING], PHPLIVE_VERSION, and (6) nav_line parameters to setup/footer.php, different vectors than CVE-2006-6769.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.96% chance of exploitation in the next 30 days, 92th percentile

Published

2007-06-06

Updated

2024-08-07

ExploitDB entries (5)

• https://www.exploit-db.com/exploits/30137
• https://www.exploit-db.com/exploits/30136
• https://www.exploit-db.com/exploits/30135
• https://www.exploit-db.com/exploits/30134
• https://www.exploit-db.com/exploits/30133

References

• CVE Record
• NVD entry

Related

• CVE-2007-3057
• CVE-2007-3061
• CVE-2007-3055
• CVE-2007-3063
• CVE-2007-3052
• CVE-2007-3064