Description
Multiple cross-site scripting (XSS) vulnerabilities in Realty Pro One allow remote attackers to inject arbitrary web script or HTML via the (1) listingid parameter to (a) images.php, (b) index_other.php, or (c) request_info.php; (2) propertyid parameter to (d) searchlookup.php, (3) id parameter to (e) images.php, or (4) agentid parameter to (f) request_info.php. NOTE: some of these issues might be resultant from SQL injection.
References
- 25772 vdb-entry
- 20060523 Realty Pro One Property Listing Script mailing-list
- 25775 vdb-entry
- 25773 vdb-entry
- 988 third-party-advisory
- ADV-2006-1985 vdb-entry
- 25774 vdb-entry
- realtyproone-multiple-xss(26677) vdb-entry
- 20286 third-party-advisory