interspireXSS.txt

`I.Vulnerability  
Interspire TrackPoint NX Cross Site Scripting Vulnerability  
  
  
II.Vendor  
Interspire (www.interspire.com)  
  
  
III.Affected Systems  
- Interspire TrackPoint NX (< 0.1)  
  
  
IV.About  
TrackPoint is a web based sales tracking software.  
  
  
V.Description  
An attacker is able to inject HTML and client-side script codes to  
TrackPoint NX login page by modifying username variable. An example provided  
below.  
  
  
VI.Exploit  
http://[www.example.com]/[tpointdir]/index.php?Page=login&Action=Login&usern  
ame=[XSS]  
  
  
VII.Vulnerability Status  
- Vulnerability discovered on 2005-11-13.  
- Vendor notified on 2005-12-09.  
- Patch released on 2005-12-12  
(http://www.interspire.com/forum/showthread.php?p=29606).  
  
  
VIII.Credits  
M.Neset KABAKLI, Wakiza Software Technologies (www.wakiza.com).  
  
  
  
`