XDT Pro Stats.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	17781
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 02 2006 12:00AM
Updated:	May 02 2006 11:05PM
Credit:	ALMaSTeR HaCKeR is credited with the discovery of this vulnerability.
Vulnerable:	Scripters.NL XDT Pro 2.3
Not Vulnerable:

XDT Pro Stats.PHP Cross-Site Scripting Vulnerability

XDT Pro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

XDT Pro version 2.3 is vulnerable to this issue; other versions may also be affected.

XDT Pro Stats.PHP Cross-Site Scripting Vulnerability

This issue can be exploited through a web client.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/xdtpro-2.3-xss.txt

XDT Pro Stats.PHP Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

XDT Pro Stats.PHP Cross-Site Scripting Vulnerability

References: