Description
Cross-site scripting (XSS) vulnerability in assess.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the reports comment box in a continue_assess action. NOTE: some of these details are obtained from third party information.
References
- 62178 vdb-entry
- evalsmsi-comment-xss(56154) vdb-entry
- 38478 third-party-advisory
- 38116 vdb-entry
- http://packetstormsecurity.org/1002-exploits/corelan-10-008-evalmsi.txt
- http://www.corelan.be:8800/index.php/forum/security-advisories/corelan-10-008-evalmsi-2-1-03-multiple-vulnerabilities/
- 20100204 CORELAN-10-008 - Multiple vulnerabilities found in evalmsi 2.1.03 mailing-list