Release Date: 2004-02-10
Critical: Less critical
Impact: Cross Site Scripting
Where: From remote
Software: JShop Server 1.x
Description:
David Sopas Ferreira has reported a vulnerability in JShop Server, allowing malicious people to conduct Cross Site Scripting attacks.
The "xSearch" parameter in the "search.php" script isn't properly validated before being returned to the user. This can be exploited to include arbitrary HTML and script code.
Solution:
The vendor has reportedly issued a new version.
Provided and/or discovered by:
David Sopas Ferreira
Original Advisory:
http://www.systemsecure.org/advisories/ssadvisory09022004.php
Source: Secunia