I.Vulnerability Interspire TrackPoint NX Cross Site Scripting Vulnerability II.Vendor Interspire (www.interspire.com) III.Affected Systems - Interspire TrackPoint NX (< 0.1) IV.About TrackPoint is a web based sales tracking software. V.Description An attacker is able to inject HTML and client-side script codes to TrackPoint NX login page by modifying username variable. An example provided below. VI.Exploit http://[www.example.com]/[tpointdir]/index.php?Page=login&Action=Login&usern ame=[XSS] VII.Vulnerability Status - Vulnerability discovered on 2005-11-13. - Vendor notified on 2005-12-09. - Patch released on 2005-12-12 (http://www.interspire.com/forum/showthread.php?p=29606). VIII.Credits M.Neset KABAKLI, Wakiza Software Technologies (www.wakiza.com).
