Secunia

Dr_insane has discovered a vulnerability in Subject Search Server, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed in the "Search for" field is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session.

The vulnerability has been confirmed in version 1.1. Other versions may also be affected.

Solution
Filter malicious characters and character sequences in a proxy server.

Provided and/or discovered by
Dr_insane

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area