Description
Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the (1) Keyword parameter in search.php and the (2) Username parameter in main.cgi.
References
- ADV-2006-2658 vdb-entry
- 20060702 [MajorSecurity #19] AutoRank <= 5.01 - Multiple XSS and cookie disclosure mailing-list
- 1016428 vdb-entry
- 20929 third-party-advisory
- http://www.majorsecurity.de/advisory/major_rls19.txt
- 20903 third-party-advisory
- ADV-2006-2659 vdb-entry
- 1016429 vdb-entry
- 18796 vdb-entry
- autorankpro-adminmain-xss(27552) vdb-entry