CLScript contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the title of a description, words in the spam filter, category name in a subcategory, help files in the manage_help function, a symbol when adding currency, and a question when adding a new FAQ upon submission to the land.php script. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

OSVDB is not aware of a solution for this vulnerability.

• Exploit Database: 19600
• Related OSVDB ID: 84673 84674 84675 84676 84677
• Vendor URL: http://www.clscript.com/
• Other Advisory URL: http://www.vulnerability-lab.com/get_content.php?id=574

• Ibrahim M. El-Sayed - Vulnerability Research Laboratory

NVD does not currently have a CVSSv2 score assigned.