ExpressionEngine Cross Site Scripting

`nGenuity Information Services - Security Advisory  
  
Advisory ID: NGENUITY-2009-003 - ExpressionEngine Persistent Cross-Site Scripting  
Application: ExpressionEngine (1.6.4 (possibly earlier)-1.6.6)  
Vendor: EllisLab, INC  
Vendor website: http://www.expressionengine.com <http://www.transparent-tech.com/>  
Author: Adam Baldwin ([email protected])  
  
I. BACKGROUND  
"ExpressionEngine is a flexible, feature-rich content management system  
that empowers thousands of individuals, organizations, and companies  
around the world to easily manage their website." [1]   
  
II. DETAILS  
While setting a display avatar in the user control panel, avatar names  
are not validated for invalid input. User input is then rendered, unaltered  
into any browser that displays that members avatar.  
  
Here is an example of an avatar name that will display an alert to any visitor  
that views the users profile.  
  
chococat.gif"><script>alert('XSS')</script><div "a  
  
III. REFERENCES  
[1] - http://expressionengine.com/  
  
IV. VENDOR COMMUNICATION  
1.17.2009 - Vendor Notified  
1.18.2009 - Initial vendor communication (details requested)  
1.18.2009 - Steps to reproduce provided to vendor  
1.21.2009 - Vendor response with public update "shortly"  
1.22.2009 - Vendor releases 1.6.7 which addresses this vulnerability  
  
Copyright (c) 2008 nGenuity Information Services, LLC  
`