Sylvain Thual has reported a vulnerability in Bug Report, which can be exploited by malicious people to conduct script insertion attacks.

Input passed to the "name", "sujet", "commentaires", "os", "navig" and "url" parameters in "bug_report.php" is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's or administrator's browser session in context of an affected site when the malicious user data is viewed via "bug_list.php" or "admin/index.php".

The vulnerability has been reported in version 1.0. Prior versions may also be affected.

Solution
Update to version 1.0.1.
Further details available in Customer Area

Provided and/or discovered by
Sylvain Thual

Original Advisory
http://www.hackisknowledge.org/Advisories/Bug%20Report%20v1.0/Bug%20Report%20v1.0.html

Deep Links
Links available in Customer Area