Description
Cross-site scripting (XSS) vulnerability in ZMS 2.9 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the raw parameter in the search field.
References
- http://www.majorsecurity.de/advisory/major_rls12.txt
- 20585 third-party-advisory
- 1016275 vdb-entry
- 1093 third-party-advisory
- 20060610 [MajorSecurity #12]ZMS<= 2.9 - XSS mailing-list
- ADV-2006-2279 vdb-entry
- zms-searchform-xss(27055) vdb-entry