OSVDB ID: 24255

Title: ARIA (Accounting Receiving and Inventory Administration) genmessage.php Message Field XSS

Info

Disclosure

Mar 28, 2006

Discovery

Mar 22, 2006

Dates

Exploit

Mar 28, 2006

Solution

Unknown

Description

ARIA (Accounting Receiving and Inventory Administration) contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the Message Field (message variable) upon submission to the genmessage.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public
Disclosure: RBS Confirmed, Uncoordinated Disclosure
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

ARIA

ARIA (Accounting Receiving and Inventory Administration)

0.99-6

References

Secunia Advisory ID: 19551
CVE ID: 2006-1435 (see also: NVD)
Vendor URL: http://arias.sourceforge.net/
Other Advisory URL: http://osvdb.org/ref/24/24255-aria.txt

Credit

security curmudgeon - jerichoattrition.org - attrition.org

Direct URL: http://osvdb.org/24255