E-Data 2.0 is susceptible to cross site scripting flaws in its search functionality.
820a3a8cc04faebb9fe783b48bdadd595291f8984a989a7e12280e2bbcad577e
------------------------------------------------------------
- EXPL-A-2005-003 exploitlabs.com Advisory 032 -
------------------------------------------------------------
- E-Data -
OVERVIEW
========
E-Data 2.0 is a powerful e-mail directory and management application
that will enhance your web site by letting visitors add, change and
delete their personal information to a directory
AFFECTED PRODUCTS
=================
E-Data 2.0
http://www.adventia.com/
DETAILS
=======
E-Data has user supplied input fields in search and in the "add to
database" functions. By inputting a query keyword followed by XSS style
script, future users may search and find the keyword that contains the
malicious xss.
The XSS is of a persistant nature as it is stored in the applications
database.
SOLUTION
========
none
1st contact: March 16, 2005 ( no reply )
PROOF OF CONCEPT
================
The vendor has a demo site, PoC is in the database,
just goto the "demo url" and enter "qwerty" in search box
demo url: http://www.adventia.com/cgi-bin/dir.pl
CREDITS
=======
This vulnerability was discovered and researched by
Donnie Werner of exploitlabs
web: http://exploitlabs.com