static XSS / SQL-Injection in Omegasoft Insel

Input passed to fields in OmegaMw7's tables isn't properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site and/or inject SQL-Commands This applies to many many standard fields i...

CVE-2006-2640

The CVE-2006-2640 entry describes a Cross-site Scripting (XSS) vulnerability in OmegaMw7a.ASP within OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL). The flaw allows remote attackers to inject arbitrary web script or HTML via the WCE parameter. According to NVD data, the vulnerability affec...

CVE-2006-2640

Cross-site scripting XSS vulnerability in OmegaMw7a.ASP in OMEGA aka Omegasoft INterneSErvicesLosungen INSEL allows remote attackers to inject arbitrary web script or HTML via the WCE parameter...

XSS in Omegasoft's Insel

Hi together, This also works on serveral web-pages of this product. http://host/OmegaMw7a.ASP?WCI=Logon&WCE=0;scriptalertunescapedocument.cookie;/script There might be some ways for SQL-Injection, too, but i am not willing to try this at the real system : Vendor notified as CC regards MC.Iglo...