CVE-2010-5284 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user profile feature to manageuser.php (2) y parameter in a newcal action to manageajax.php and the (3) pic parameter to thumb.php.

Reference

http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt http://secunia.com/advisories/41805 http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt http://www.exploit-db.com/exploits/15240 http://www.securityfocus.com/bid/44050