APC Switched Rack PDU Cross Site Scripting

`###########################################  
  
#APC Switched Rack PDU XSS Vulnerability#  
#By Jamal Pecou #  
#jpecou (at) gmail (dot) c0m. #  
  
###############Product Info#################  
  
#Product Info(Tested Versions)#  
Model = AP7932  
Harware Revision = B2  
  
#Application Module#  
Name = rpdu  
Version = v3.3.3(Tested First)   
Version = 3.7.0(Current)  
  
#APC OS (AOS)  
Name = aos  
Version = v3.3.4  
  
###############Vulnerability################  
  
XSS Vulnerability:  
  
The APC Switch RACK PDU web administration login page is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.   
  
The script "login1" located in the Forms directory fails to properly sanitize user input data in the login_username field  
  
####################PoC#####################  
  
Proof-of-Concept  
  
http://<PDU IP>/Forms/login1?login_username=<ScRiPt>alert('hello');</ScRiPt>  
  
  
################Additional#################  
  
Jun 17th 2009 - Vulnerability Discovered  
  
Jun 18th 2009 - Contacted Vendor  
  
Jun 21st 2009 - APC Creates a ticket and enters finding into bug tracking database.  
  
Dec 14th 2009 - APC, no patches released.  
  
###########################################  
`