OSVDB ID: 60083

Title: VirtualIQ Pro tvserver/reports/virtualIQAdminReports.do reportName Parameter XSS

Info

Disclosure

Nov 07, 2009

Discovery

Unknown

Dates

Exploit

Nov 07, 2009

Solution

Oct 14, 2009

Description

VirtualIQ Pro contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'reportName' parameter upon submission to the 'tvserver/reports/virtualIQAdminReports.do' script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified, Vendor Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

Upgrade to version 3.5 build 10.14.2009 or higher, as it has been reported to fix this vulnerability. Note that this flaw was fixed in the 2009-10-14 release without a change in version number. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

CVE ID: 2009-4848 (see also: NVD)
Secunia Advisory ID: 37359
Related OSVDB ID: 60079 60080 60081 60082 60084
Other Advisory URL: http://www.securenetwork.it/ricerca/advisory/download/SN-2009-02.txt
Vendor URL: http://www.toutvirtual.com

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/60083