IBSng all version Cross-Site Scripting Vulnerability

2011-11-06T00:00:00
ID SECURITYVULNS:DOC:27272
Type securityvulns
Reporter Securityvulns
Modified 2011-11-06T00:00:00

Description

================= APA-IUTcert ================= Title: IBSng all version Cross-Site Scripting Vulnerability Vendor: www.parspooyesh.com Type: Cross-Site Scripting Vulnerability Fix: N/A

================== nsec.ir ================= Description: Input passed via the "str" parameter to IBSng/util/show_multistr.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. This bug can be exploited by malicious people with out any privilege access to conduct cross-site scripting attacks.

PoC : http://[target]/IBSng/util/show_multistr.php?str=[xss]

Original Advisory : http://nsec.ir/

Credit: Isfahan University of Technology - Computer Emergency Response Team