Online Work Order Suite Lite Edition Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	42535
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 10 2009 12:00AM
Updated:	Aug 10 2009 12:00AM
Credit:	Moudi
Vulnerable:
Not Vulnerable:

Online Work Order Suite Lite Edition Multiple Cross Site Scripting Vulnerabilities

Online Work Order Suite Lite Edition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Online Work Order Suite Lite Edition 3.10 is vulnerable; other versions may also be affected.

Online Work Order Suite Lite Edition Multiple Cross Site Scripting Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/42535.txt

Online Work Order Suite Lite Edition Multiple Cross Site Scripting Vulnerabilities

Solution:
These issues may have been fixed in Online Work Order Suite Lite Edition for ASP 3.20. Please see the references for details.

Online Work Order Suite Lite Edition Multiple Cross Site Scripting Vulnerabilities

References:

• Online Work Order Suite Lite Edition Homepage (OnlineTechTools)