A vulnerability has been identified in SmartPPC Pro, which may be exploited by attackers to inject malicious HTML code. This flaw is due to input validation errors in the "directory.php", "frames.php", and "search.php" scripts when processing a specially crafted "username" parameter, which may be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.

Affected Products

SmartPPC Pro

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2005/2581

Credits

Vulnerability reported by BiPi HaCk

Changelog

2005-11-25 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.