TITLE: Pinnacle ShowCenter Skin File Cross-Site Scripting Vulnerability
SECUNIA ADVISORY ID: SA12613
VERIFY ADVISORY: http://secunia.com/advisories/12613/
CRITICAL: Less critical
IMPACT: Cross Site Scripting
WHERE: >From remote
SOFTWARE: Pinnacle ShowCenter 1.x http://secunia.com/product/3938/
DESCRIPTION: Secunia Research has discovered a vulnerability in Pinnacle ShowCenter, which can be exploited by malicious people to conduct cross-site scripting attacks.
Invalid input passed to the "Skin" parameter in "SettingsBase.php" isn't sanitised before being returned to the user in a error page. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site by tricking the user into visiting a malicious web site or follow a specially crafted link.
The vulnerability has been confirmed in version 1.51 build 121. Other versions may also be affected.
SOLUTION: No vendor solution is currently available. The vendor has been contacted multiple times, but has not responded.
Filter malicious characters and character sequences in a proxy or firewall with URL filtering capabilities.
PROVIDED AND/OR DISCOVERED BY: Secunia Research
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.