cve/cves/2007/CVE-2007-3060.md

CVE-2007-3060

Description

Multiple cross-site scripting (XSS) vulnerabilities in PHP Live! 3.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to (a) chat.php, (2) LANG[DEFAULT_BRANDING] and (3) PHPLIVE_VERSION parameters to (b) help.php, the (4) admin[name] parameter to (c) admin/header.php, and the (5) BASE_URL parameter to (d) super/info.php, and in some cases, the LANG[DEFAULT_BRANDING], PHPLIVE_VERSION, and (6) nav_line parameters to setup/footer.php, different vectors than CVE-2006-6769.

POC

Reference

No PoCs from references.

Github

No PoCs found on GitHub currently.

ExploitDB

• https://www.exploit-db.com/exploits/30137
• https://www.exploit-db.com/exploits/30136
• https://www.exploit-db.com/exploits/30135
• https://www.exploit-db.com/exploits/30134
• https://www.exploit-db.com/exploits/30133