Simple Directory Listing Cross Site Scripting

`## Security Advisory : Cross-Site Scripting flaw in Simple Directory Listing  
##  
Discovered by ==> Amol Naik (amolnaik4_at_gmail_dot_com)  
  
## Overview ##  
--------------  
Quote from from http://simpledirectorylisting.net/ :  
"Simple Directory Listing is a single file php script which functions as  
directory listing in an apache http server. It provides many useful  
functions like copy, delete, read/write, etc.". There are 21,739,293  
downloads from sourceforge.net.  
  
  
## Vulnerability Description ##  
-----------------  
Simple Directory Listing is vulnerable to Cross-Site Scripting, allowing  
injection  
of malicious code in the context of the application.  
  
  
  
## Technical Details ##  
-------------  
Vulnerable Product : Simple Directory Listing 2.1_beta1  
Download :  
http://sourceforge.net/projects/simpledirectory/files/simpledirectorylisting/SDL2.1_beta1/SDL2.1_beta1.zip/download  
Vulnerability Type : Cross-Site Scripting (XSS)  
Affected page : SDL2.php  
Vulnerable parameters : cwdRelPath  
  
  
  
## Timeline ##  
--------------  
Bug Discovered : October 3rd, 2009  
Informed Vendor : October 3rd, 2009 but no response received till date.  
  
  
## Proof of concept ##  
----------------------  
  
http://localhost/simpledirectorylisting/SDL2.php?cwdRelPath=  
'><script>alert(1)</script>  
`