Secunia

Corsaire has reported two vulnerabilities in WebIntelligence, which can be exploited by malicious people to delete sensitive information and conduct cross-site scripting attacks.

1) Some security checks are only performed on the client-side and not on the server-side. This can be exploited to delete documents by directly accessing a specially crafted URL with the document ID and document name parameters set.

2) Input passed to the document name when uploading documents isn't properly sanitised on server-side before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

The vulnerabilities have been reported in WebIntelligence 2.7 and BusinessObjects 5.1. Other versions may also be affected.

Solution
WebIntelligence 2.7.0 - 2.7.2 and InfoView 5.1.4 - 5.1.6 (SP4-SP6)
Further details available in Customer Area

Provided and/or discovered by
Stephen de Vries, Corsaire.

Original Advisory
http://www.corsaire.com/advisories/c040527-001.txt
http://www.corsaire.com/advisories/c040527-002.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area