OSVDB ID: 24255

Title: ARIA (Accounting Receiving and Inventory Administration) genmessage.php Message Field XSS

Info

Disclosure

Mar 28, 2006

Discovery

Mar 22, 2006

Dates

Exploit

Mar 28, 2006

Solution

Unknown

Description

ARIA (Accounting Receiving and Inventory Administration) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the Message Field (message variable) upon submission to the genmessage.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

ARIA

ARIA (Accounting Receiving and Inventory Administration)

0.99-6

References

Other Advisory URL: http://osvdb.org/ref/24/24255-aria.txt
Secunia Advisory ID: 19551
CVE ID: 2006-1435 (see also: NVD)
Vendor URL: http://arias.sourceforge.net/

Credit

security curmudgeon - jerichoattrition.org - attrition.org

Direct URL: http://osvdb.org/36218