Vendor : fusetalk URL : http://www.fusetalk.com/ Version: 4.0 Risk : Cross site scripting Description: Fusetalk is a discussion forum solution that provides a powerful and simple method of web-based collaboration. Cross site scripting: The filtering script for the img src= doesnt filter " if preceeded by a ?. The cross site scripting works because the <img src=" tag can be closed by a target url with " which then permits the user to use such oneventhandles as onmouseover. Solution: The easiest way would be to just replace all characters with their &#xx; equivilant. Credits: Credits goto my loving fiance, you push me todo things i never thought possible. Exploit: This is exploited by passing a img src with malicious javascript. Spiffomatic64 Hacking is an art-form
