Private Message System 2.x - 'index.php?Page' Cross-Site Scripting

Author: David S. Ferreira
type: webapps
platform: php
port: 
date_added: 2003-12-27 
date_updated: 2012-12-18 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/9308/info

Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML and script code embedded in URI parameters. If the link is followed, the attacker-supplied code may be rendered in the victim user's browser.

Possible consequences of exploitation include theft of cookie-based authentication credentials or using the issue as an attack vector to exploit latent web browser security flaws.

http://www.example.com/index.php?page=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E