This was already disclosed on 2008-01-06 (CVE-2008-4612) in version 4.0. On Tue, 29 Jun 2010, advisory@xxxxxxxxxxx wrote: : Vulnerability ID: HTB22442 : Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_portalapp_1.html : Product: PortalApp : Vendor: Latek : Vulnerable Version: 4.0 and Probably Prior Versions : Vendor Notification: 14 June 2010 : Vulnerability Type: XSS (Cross Site Scripting) : Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response : Risk level: Medium : Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) : : Vulnerability Details: : User can execute arbitrary JavaScript code within the vulnerable application. : : The vulnerability exists due to failure in the "/content.asp" script to properly sanitize user-supplied input in "keywords" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data. : : An attacker can use browser to exploit this vulnerability. The following PoC is available: : : : http://host/content.asp?CatId=&ContentType=&keywords=sd%27%22+style=position:absolute;left:0;top:0;width:100%25;height:100%25;+onmouseover=alert%28123%29+x&search=%3E&do_search=1 : : :
