Embedthis Appweb Web Server 3.2.2-1 Cross Site Scripting

`  
Embedthis Appweb Web Server 3.2.2-1 (Ejscript) Remote XSS Vulnerability  
  
  
Vendor: Embedthis Software LLC  
Product web page: http://www.appwebserver.org, http://www.ejscript.org  
Version affected: 3.2.2-1  
  
Summary: Appweb has a multi-threaded, event-driven, core to deliver  
exceptional throughput, response and outstanding memory utilization.  
It is compact and will embed using as little as 800K of memory.  
  
Desc: Appweb Web Server suffers from a remote reflected Cross-Site  
Scripting vulnerability when input passed to the Ejscript web  
framework is not properly sanitized, allowing the attacker to  
execute arbitrary HTML and script code in a user's browser  
session and aid in phishing attacks.  
  
Tested on: Microsoft Windows XP Professional SP3 (EN)  
  
Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic  
liquidworm gmail com  
Zero Science Lab - http://www.zeroscience.mk  
  
Advisory ID: ZSL-2010-4985  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4985.php  
  
12.10.2010  
  
  
PoC:  
  
http://localhost/ejs/%3Cscript%3Ealert%281%29%3C/script%3E  
`