Description
Multiple cross-site scripting (XSS) vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the (1) topic parameter to sw/add_topic.php or (2) nick parameter to sw/chat/message.php.
References
- 101891 vdb-entry
- 101892 vdb-entry
- commandschool-addtopic-xss(90178) vdb-entry
- commandschool-message-xss(90179) vdb-entry
- 64707 vdb-entry
- http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html