This doesnt look like a fusebox vulnerability. Rather it is a vulnerability of any web application that displays URL values in the processing page.
Fusebox does not output these values to HTML by default. The developer of the application would need to code it in that manner. For exmaple there are a number of fusebox applications that do not output html at all. Whoever submitted this to SecurityFocus is a retard. -Adam On 8/9/05, Jeremy Adams <[EMAIL PROTECTED]> wrote: > Anyone else seen this? Just a reference to a cross-site scripting > attack, but I thought it interesting that it was posted as a > vulnerability with the fusebox framework as opposed to poor code > implementation by the application programmer. > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Logware (www.logware.us): a new and convenient web-based time tracking application. Start tracking and documenting hours spent on a project or with a client with Logware today. Try it for free with a 15 day trial account. http://www.houseoffusion.com/banners/view.cfm?bannerid=67 Message: http://www.houseoffusion.com/lists.cfm/link=i:4:214180 Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/4 Subscription: http://www.houseoffusion.com/lists.cfm/link=s:4 Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4 Donations & Support: http://www.houseoffusion.com/tiny.cfm/54
