OSVDB ID: 24441

Title: ARIA (Accounting Receiving and Inventory Administration) gencompanyadd.php Multiple Variable XSS

Info

Disclosure

Apr 07, 2006

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

ARIA contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'name', 'address1', 'address2', 'city', 'email', and 'web' variables upon submission to the gencompanyadd.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

ARIA

ARIA (Accounting Receiving and Inventory Administration)

0.99-6

References

Bugtraq ID: 17411
Related OSVDB ID: 24255 24439 24440
ISS X-Force ID: 25688
Secunia Advisory ID: 19551
CVE ID: 2006-1435 (see also: NVD)
Vendor URL: http://arias.sourceforge.net/

Credit

Secunia Security Advisories - sec-advsecunia.com - Secunia

Direct URL: http://osvdb.org/36218