Release Date: 2004-02-05
Critical: Less critical
Impact: Cross Site Scripting
Where: From remote
Software: RxGoogle 1.x
Description:
Shaun Colley has reported a vulnerability in RxGoogle, allowing malicious people to conduct Cross-Site Scripting attacks.
The problem is that the "query" parameter isn't properly verified in "rxgoogle.cgi". This can be exploited to include arbitrary HTML and script code.
The vulnerability has been reported in version 1.0.
Solution:
Edit the source to ensure that input passed to the "query" parameter is sanitised properly.
Provided and/or discovered by:
Shaun Colley
Source: Secunia