Working Resources BadBlue 1.7 - 'ext.dll' Cross-Site Scripting

Author: Matthew Murphy
type: remote
platform: windows
port: 
date_added: 2002-06-23 
date_updated: 2012-09-28 
verified: 1 
codes: CVE-2002-1685;OSVDB-21390 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5086/info

BadBlue is a P2P file sharing application distributed by Working Resources. The ext.dll ISAPI does not sufficiently sanitize input. Because of this, it is possible for a user to create a custom URL containing script code that, when viewed in a browser by another user, will result in the execution of the script code. This could allow for the execution of malicious JavaScript in the context of a trusted site.

http://target/ext.dll?MfcISAPICommand=LoadPage&page=search.htx&a0=%3Cscript%3Ealert('lame')%3C/script%3E&a1=0&a2=1&a3=6