IBSng Cross Site Scripting

Type packetstorm
Reporter nsec.ir
Modified 2011-11-02T00:00:00


                                            `================= APA-IUTcert =================  
Title: IBSng all version Cross-Site Scripting Vulnerability  
Vendor: www.parspooyesh.com  
Type: Cross-Site Scripting Vulnerability  
Fix: N/A  
================== nsec.ir =================  
Input passed via the "str" parameter to IBSng/util/show_multistr.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.  
This bug can be exploited by malicious people with out any privilege access to conduct cross-site scripting attacks.  
PoC : http://[target]/IBSng/util/show_multistr.php?str=[xss]  
Original Advisory : http://nsec.ir/  
Credit: Isfahan University of Technology - Computer Emergency Response Team