Open Business Management 1.0.3 pl1 list_index.php Multiple Parameter XSS

2006-06-07T00:00:00
ID EDB-ID:27997
Type exploitdb
Reporter r0t
Modified 2006-06-07T00:00:00

Description

Open Business Management 1.0.3 pl1 list_index.php Multiple Parameter XSS. CVE-2006-3009. Webapps exploit for php platform

                                        
                                            source: http://www.securityfocus.com/bid/18348/info
   
Open Business Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize HTML and script code from user-supplied input to several parameters before returning to the user.
   
   
An attacker could exploit this vulnerability to inject hostile HTML and script code into the browser session of other users of the application.

http://obm-host/list/list_index.php?action=search&tf_name=[XSS]
http://obm-host/list/list_index.php?action=search&tf_name=&tf_contact=[XSS]